Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects potential data exfiltration by the BlackBeard backdoor, associated with Boggy Serpens (MuddyWater). The malware abuses the HTTP 'Expires' header in client requests to exfiltrate encrypted system data to its command and control server. The 'Expires' header is a standard response header, so its presence in a request is highly anomalous.
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
Detects the loading of jli.dll from the C:\ProgramData\USOShared directory. This behavior is indicative of DLL sideloading via a legitimate Java process, a consistent post-exploitation tactic used by the LeakNet ransomware group.
Detects the creation of a registry key used by the BlackBeard backdoor for persistence. The malware associates a custom file extension (.wdlp) with a malicious script (WebDeepPlayer.scr) to ensure it is executed on user logon.
Detects the C2 communication of the Slopoly PowerShell backdoor, used by the Hive0163 group. It looks for specific HTTP POST requests containing a JSON body with characteristic keys.
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
Detects multiple crashes from key iOS system processes within a short time window. This pattern is indicative of a failed memory corruption attempt, consistent with the sandbox escape and privilege escalation techniques used by the DarkSword exploit kit.
Detects process command lines containing strings characteristic of the GHOSTBLADE dataminer, a payload deployed by UNC6353 via the DarkSword exploit. These strings are hardcoded file paths used for data collection and exfiltration.
Detects the self-deletion mechanism of the Interlock ransomware. The malware executes `rundll32.exe` to call a function within a randomly named DLL file with a `.wasd` extension, passing its own file path as an argument to be deleted.
Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).
Page 17 of 30