Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
Detects DNS resolution requests for known Masjesu botnet command and control (C2) domains. Masjesu relies on multiple failover domains to fetch its secondary payload and receive DDoS commands.
Detects attempts to modify the permissions of the /tmp directory to read-only (CHMOD 400), a tactic used by the Masjesu botnet to prevent rival malware from writing to shared temporary space.
Detects the use of PowerShell's BitsTransfer module to download a payload named "syncobs.exe". This specific file and behavior are associated with the REF6598 campaign, where it is used as a secondary staging mechanism to deliver the PhantomPull in-memory loader and ultimately the PhantomPulse RAT.
Detects instances where the legitimate Obsidian application spawns shell or scripting interpreters (PowerShell, cmd, sh, bash, zsh). This behavior is associated with the REF6598 campaign, where attackers abuse the Obsidian "Shell Commands" community plugin to execute malicious code and deliver the PhantomPulse RAT.
Detects network connections to the primary staging server IP address (195.3.222.251) used to host the intermediate PowerShell script and the PhantomPull loader associated with the REF6598 campaign and the PhantomPulse RAT.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for a unique URL pattern in process command lines, indicating communication with the PhantomPulse C2 server.
Detects the execution of 'syncobs.exe', which is identified as the primary loader component for the PhantomPulse RAT. This loader is responsible for decrypting and reflectively loading the final RAT payload. The detection focuses on the specific filename, which is considered highly indicative of this threat.
Identifies the creation of a specific LaunchAgent plist file associated with the PhantomPulse macOS AppleScript dropper, indicating persistence on macOS systems.
Page 10 of 30