Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the creation of a system service for NSecKrnl using sc.exe, indicating a potential Bring Your Own Vulnerable Driver (BYOVD) attack. Warlock has been observed utilizing the vulnerable NSecKrnl.sys driver to terminate kernel-level security products before deploying ransomware.
Detects network connections to domains identified as being part of the DarkSword iOS exploit kit delivery or command-and-control infrastructure. The DarkSword exploit kit is actively being used by multiple threat actors (UNC6353, UNC6748, PARS Defense) to target iOS users.
Detects the creation of an app-specific password named 'ZimbraWeb' via Zimbra SOAP API. This specific persistent credential name is a known mechanism utilized in the Operation GhostMail campaign by a Russian APT.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects the invocation of the Windows Credential Manager interface via rundll32.exe loading keymgr.dll with the KRShowKeyMgr export. This technique is used to view or dump stored credentials and is known to be employed by the Warlock ransomware group during post-exploitation lateral movement.
Detects suspicious PowerShell execution patterns commonly associated with the ClickFix initial access technique, where a user is tricked into pasting and executing a malicious script.
Detects C2 communication from Boggy Serpens (MuddyWater) backdoors like Nuso and BlackBeard, which use non-standard HTTP status codes (201, 202, 418) to receive commands from known C2 servers.
Detects DNS resolution requests to the Operation GhostMail exfiltration subdomains (*.i.zimbrasoft.com.ua) and main domain. DNS exfiltration is the primary channel used by this APT to steal credentials and 2FA codes even when HTTPS is blocked.
Detects access to the Zimbra mailbox export endpoint (/home/~/?fmt=tgz). This native Zimbra feature is actively abused by APT actors (such as in Operation GhostMail) to silently export emails without deploying custom collection tools.
Detects specific log messages written to the iOS Unified Log by the DarkSword implant (GHOSTBLADE). These messages, which include tags like '[DarkSword-WIFI-DUMP]' and '[MAIN]', are unique to the malware and indicate that the data exfiltration modules are running. The GHOSTBLADE implant, used by UNC6353 in the DarkSword campaign, leaves distinct and high-confidence log messages in iOS Unified Logs during its operation. These logs are a clear indicator of a successful compromise.
Page 16 of 30