Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the use of the klist utility via cmd.exe to enumerate active authentication credentials (Kerberos tickets) on a host. This discovery step is consistently used by threat actors, such as LeakNet, to map out accessible credentials before attempting lateral movement with tools like PsExec.
Detects network traffic matching the specific URI structure used by LeakNet for command-and-control beaconing. This behavior has been consistently observed across multiple LeakNet incidents following initial access.
Detects the Deno runtime executing base64-encoded payloads via data URIs. This technique is used by threat actors, such as LeakNet, to run JavaScript payloads directly in memory, evading traditional file-based detection.
Detects the execution of PowerShell or VBScript scripts matching the naming conventions "Romeo*.ps1" or "Juliet*.vbs". These scripts are utilized as initial triggers for a stealthy Deno-based in-memory loader, a technique recently observed in LeakNet ransomware campaigns following initial access.
Detects the execution of the open-source Yuze tool via rundll32 to establish a reverse SOCKS5 proxy tunnel. The Warlock ransomware group has been observed using this lightweight C-based tunneling tool to maintain persistent C&C access across multiple ports.
Detects Zimbra SOAP API requests attempting to enable IMAP access by setting zimbraPrefImapEnabled. This is a known persistence technique used by threat actors (such as in Operation GhostMail) to silently enable mail protocols, bypassing the web UI to maintain access using stolen app-specific passwords.
Detects the execution of the Warlock ransomware payload using rundll32.exe to call the specific 'RunCryptor' export function from 'run.dll'. This activity represents the final stage of the attack chain, immediately preceding enterprise-wide file encryption.
Detects a User Account Control (UAC) bypass attempt by abusing the CMSTPLUA COM interface. Adversaries can leverage this legitimate Windows binary to execute code with elevated privileges without prompting the user. This technique is used by malware such as SILENTCONNECT.
Detects the execution of VS Code CLI running in tunnel service mode, indicating potential C&C tunneling. Threat actors increasingly abuse VS Code's native tunneling capabilities to establish covert C&C channels that blend with developer traffic.
Detects the execution of msiexec.exe to download and install a remote MSI payload from Supabase cloud storage. This technique is known to be used by the Warlock ransomware group to silently deploy the Velociraptor C&C framework while evading network detections.
Page 15 of 30