Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the creation of a scheduled task named 'TaskSystem' with SYSTEM privileges, a specific behavior of the Interlock ransomware.
Detects potential COM hijacking used by Sednit (APT28) malware like BeardShell and SlimAgent for persistence. This involves modifying InprocServer32 registry keys to point to malicious DLLs.
Detects the creation of HTML files with specific formatting tags used by the SlimAgent keylogger, a tool used by Sednit (APT28).
Detects outbound network traffic to Icedrive domains from non-browser and non-Icedrive client processes, which could indicate C2 communication by the BeardShell implant used by Sednit (APT28).
Detects outbound network traffic to Filen domains from non-browser and non-Filen client processes, which could indicate C2 communication by Sednit's modified Covenant implant.
Detects the use of "net.exe" to mount a remote WebDAV share, where the command is recorded in the Explorer RunMRU registry key. This technique was observed in a recent ClickFix campaign for initial access.
Detects network connections from a trojanized "WorkFlowy.exe" process to a known command and control (C2) server. This behavior was observed in a ClickFix campaign where a legitimate Electron application was modified to act as a C2 beacon and dropper, communicating with the C2 every two seconds.
Detects the creation or modification of "app.asar" files, which are archives used by Electron-based applications. Adversaries can replace this file in a legitimate, signed application to execute malicious code, as seen in a recent ClickFix campaign trojanizing the WorkFlowy application.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
Page 18 of 30