Anitha A
@aanitha0 followers0 downloads35 copies0 likes66 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
6
4
2
2
2
Platforms
6
Products / Services
4
2
2
MITRE Techniques
4
2
2
2
2
CVEs
2
2
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
Detects Python processes executing common system and network enumeration tools (e.g., net.exe, tasklist.exe, dsquery, Get-ADUser). This activity is indicative of the SynkLoader system profiler module, used to size the victim environment for ransom-value estimation and lateral movement preparation.
Detects command-line execution (cmd.exe, powershell.exe) originating from a python.exe process tree, correlated with long-running, frequent outbound public network connections from the same python.exe process. This behavior is consistent with the SynkLoader RAT module, where a loader uses a Python process to execute system commands and maintain persistent C2 channels.
Detects Python processes executing common system and network enumeration tools (e.g., net.exe, tasklist.exe, dsquery, Get-ADUser). This activity is indicative of the SynkLoader system profiler module, used to size the victim environment for ransom-value estimation and lateral movement preparation.
Detects command-line execution (cmd.exe, powershell.exe) originating from a python.exe process tree, correlated with long-running, frequent outbound public network connections from the same python.exe process. This behavior is consistent with the SynkLoader RAT module, where a loader uses a Python process to execute system commands and maintain persistent C2 channels.