Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
Detects the secondary staging mechanism used by the intermediate PowerShell script before the PhantomPull in-memory loader is executed. This rule specifically looks for PowerShell or PowerShell Core processes executing commands that utilize `Start-BitsTransfer` to download a file named `syncobs.exe`.
Detects the usage of Cloud Files API (CfRegisterSyncRoot or CfConnectSyncRoot) by untrusted applications. This technique is notably used by the BlueHammer LPE zero-day to set a timing trap and freeze Windows Defender.
Detects the creation of a shortcut (.lnk) file in the Windows Startup folder containing 'Edge' or 'msedge' in its name. This matches the persistence mechanism used by LucidRook and its droppers (like LucidPawn) which drop a disguised Microsoft Edge shortcut to execute a renamed DISM binary.
Detects network connections over FTP (port 21) to specific compromised IP addresses abused by the LucidRook malware. The threat actor utilizes these Taiwanese FTP servers to stage payloads and receive exfiltrated data.
Detects rapid password change (Event ID 4724) or attempt (Event ID 4723) events on local administrator accounts within a short timeframe. This behavior is indicative of the BlueHammer zero-day local privilege escalation (LPE), where an attacker temporarily overwrites a local admin's password to spawn a SYSTEM shell and immediately restores the original hash to evade detection.
Detects the creation of a DLL named DismCore.dll within the ProgramData or AppData\Local\Microsoft\WindowsApps directories. This behavior is indicative of potential LucidPawn/LucidRook DLL sideloading preparation where it attempts to hijack the search order of legitimate DISM binaries.
Detects the execution of the PowerShell Pester module's Build.bat script being used as a LOLBAS proxy to execute hidden payloads, as observed in LucidRook/LucidPawn malware campaigns targeting Taiwanese organizations.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Generic rule content from file: untitled_rule
Page 11 of 30