Richard Kohler
@djrk01Completionist
0 followers9 downloads22 copies0 likes141 views
24 detections
Filters
Last updated
All Time
Detection languages
24
MITRE Techniques
2
2
Detects a potentially compromised webshell being executed on windows IIS server. This would mean a threat actor has gained access into a server, potentially looking to backdoor or elevate privileges.
Detects compromised users who are disabling windows backups. Seen commonly in pre encryption during ransomware attacks.
Detects rundll32.exe loading a DLL from a user-writable staging directory and invoking its Begin export, a loader pattern used in the Ghost CMS/ClickFix campaign. Since legitimate software rarely loads DLLs from these locations via a Begin export, this is a high-fidelity indicator of malicious proxy execution (MITRE T1218.011).
Detects a potential remote installation of application through http. Look for suspicious parent processes or unusual application installs.
Page 3 of 3