Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects a Python process attempting to read the memory (`/proc/<pid>/mem` or `/maps`) of a GitHub Actions `Runner.Worker` process. This is indicative of the credential dumping technique used by the TeamPCP threat actor during the Trivy supply chain compromise to extract highly privileged injected secrets.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
Detects the creation of a malicious Python script (`sysmon.py`) within the user's systemd directory. This specific file and path are utilized by the TeamPCP compromised Trivy binary to establish persistence on developer machines when the GITHUB_ACTIONS environment variable is not set to "true".
Detects the execution of msiexec.exe to download and install packages from remote locations. This activity is frequently observed in LeakNet ClickFix campaigns where users are tricked into copying and pasting malicious commands via fake verification prompts.
Detects the execution of an RMM tool where the filename is prepended with an IPv4 address (e.g., '45.119.55.66ClientSetup.exe'). This technique is actively used by the Silver Fox (Void Arachne) intrusion set to pass Command and Control (C2) IP addresses directly to the legitimate SyncFutureTec RMM tool, evading signature-based detection while maintaining the binary's valid digital signature.
Detects the creation of the ValleyRAT configuration file 'bb.jpg' in the public download directory. This activity is actively associated with Silver Fox (Void Arachne) campaigns targeting South Asia.
Detects the creation of specific file artifacts (WhatsAppData.zip, whatsapp_backup.lock) associated with a Python-based WhatsApp stealer deployed by the Silver Fox (Void Arachne) intrusion set. This malware is designed to collect credentials and host data.
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Detects the presence of HTML tags within the URL query parameters of Claude chat application pre-fill URLs. Attackers can use this to embed invisible instructions (prompt injection) that the AI processes but the user does not see in the chat interface.
Page 14 of 30