Subhankar H
@Shubho570 followers238 downloads17 copies0 likes800 views
18 detections
Filters
Last updated
All Time
Detection languages
11
7
Categories
7
4
3
3
3
Platforms
12
MITRE Techniques
8
5
5
4
3
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
Detects the execution of the UnRAR utility with a password to extract an archive. This technique is used by threat actors like the Kimsuky group and XWorm RAT to deliver malicious payloads.
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects potential execution of BQTLock ransomware by identifying characteristic command-line strings, credential staging files, and associated UAC bypass techniques.
Detects various activities associated with the DRAYN malware family, as described in a detailed analysis. This includes stealthy installation command-line arguments, PowerShell-based system reconnaissance, and modification of file permissions for defense evasion.
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
Detects suspicious file writes or modifications within the 'CryptnetUrlCache' directory. Malware abuses this directory to hide payloads and configuration files, blending in with legitimate system activity.
Page 2 of 2