Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the execution of the native macOS dscl utility with the -authonly flag. This technique is used by malware, such as Miolab Stealer, to silently validate phished user credentials captured via fake authentication prompts before escalating privileges or exfiltrating data.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz'. This custom header is used by the TeamPCP credential harvester to exfiltrate collected sensitive credentials (cloud, database, SSH, Kubernetes) to an attacker-controlled server following the compromise of the litellm PyPI package.
Detects the execution of processes from the '/tmp/pglog' path or where the binary is named 'pglog'. Threat actor TeamPCP utilizes this specific filename to masquerade their downloaded malicious secondary payload as a legitimate PostgreSQL process, following the compromise of the litellm PyPI package.
Detects the loading of 'libcurl.dll' from suspicious or temporary directories such as ProgramData, Users\Public, or Temp. This behavior is associated with DLL side-loading techniques, such as those used by the BRUSHLOGGER keylogger which masquerades as 'libcurl.dll' to execute malicious code and capture keystrokes.
Detects file creation events for the TeamPCP systemd persistence mechanism, specifically looking for 'sysmon.py' or 'sysmon.service' dropped in hidden user config directories. This persistence mechanism ensures the attacker maintains access and can download further stages via C2 even if the original vulnerable litellm process terminates.
Detects command line executions using the 7z compression utility to extract archives with a specific hardcoded password (-pppp). This behavior is an established staging artifact observed in ClickFix campaigns (such as the QuickBooks and Booking.com clusters) to deploy payloads like the NetSupport RAT.
Detects the creation of the specific mutex 'Windows-Updates-KB852654856' used by the BRUSHLOGGER keylogger to enforce single-instance execution. The malware decodes this string from Base64 at runtime to mimic a legitimate Windows Update KB identifier.
Detects the creation of a GitHub repository named `tpcp-docs`. This specific repository name is utilized as a fallback exfiltration channel by the TeamPCP threat actor. During the Trivy supply chain attack, the malware abused stolen GitHub tokens to create this public repository on the victim's account to host stolen data as release assets when the primary exfiltration method failed.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Page 13 of 30