Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.
Detects the execution of an osascript command that queries system_profiler for SPMemoryDataType and checks for virtualization software strings like QEMU or VMware. This technique is actively used by the Atomic macOS Stealer (AMOS) to evade automated analysis environments and sandboxes.
Generic rule content from file: untitled_rule
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
Detects attempts to access or exfiltrate the default Kubernetes service account token file using web utilities like curl or wget. This activity is commonly observed in attacks by threat actors such as Slow Pisces to escalate privileges or move laterally from a compromised pod into backend cloud infrastructure.
Detects the use of the curl command-line utility to perform an HTTP POST request uploading a .zip archive. This behavior is characteristic of the exfiltration phase used by macOS malware, such as Miolab Stealer, to silently transfer staged sensitive files and system profiles to a remote command-and-control server.
Detects the execution of a batch file from the non-standard C:\Users\Public\Music\ directory via cmd.exe. This behavior is associated with the intermediate stage of Kimsuky campaigns where it is used to download further payloads.
Generic rule content from file: untitled_rule
Detects the use of the macOS native ditto command to compress files and directories into a .zip archive. This technique is frequently used by macOS stealers, such as Miolab and AMOS, to quietly stage collected sensitive documents (PDFs, TXTs, RTFs) and profile data before exfiltrating it to a remote command-and-control server, avoiding the need to drop noisy third-party archiving tools.
Page 12 of 30