Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects a vulnerable GitHub Actions workflow configuration known as a "Pwn Request". This occurs when a workflow is triggered by `pull_request_target` but checks out and executes untrusted code from the head of the pull request (`${{ github.event.pull_request.head.sha }}`). This allows an attacker to run arbitrary code with the permissions of the target repository, including access to secrets. This pattern was actively exploited by the 'hackerbot-claw' campaign. This rule should be applied to files in the `.github/workflows/` directory.
Detects HTTP requests to download the BoryptGrab stealer, which uses a specific URL pattern containing a hardcoded build name. This activity is characteristic of the initial launchers used in the BoryptGrab campaign to fetch the main stealer component from a C2 server.
Detects a web server process spawning tools commonly used for data staging and exfiltration, such as rar.exe, certutil.exe, and type.exe. This behavior is characteristic of the CL-UNK-1068 actor's exfiltration TTP, often performed via a web shell.
Detects files signed with a code-signing certificate issued to 'Amy Cherne'. This certificate was observed being used by the Iranian APT group Seedworm (aka MuddyWater) to sign new backdoors named Dindoor and Fakeset.
Detects the execution of `deno.exe`, the Deno runtime for JavaScript and TypeScript. This was observed being leveraged by the Iranian APT group Seedworm (aka MuddyWater) to execute a new backdoor named Dindoor.
Detects the use of Rclone to exfiltrate data to a Wasabi cloud storage bucket. This technique was observed being used by the Iranian APT group Seedworm.
Detects CL-UNK-1068's custom-compiled Fast Reverse Proxy (FRP) variant based on unique command-line artifacts.
Detects network traffic to known command and control (C2) domains used by the Iranian APT group Seedworm to distribute the Fakeset backdoor. These domains are hosted on the Backblaze cloud storage service.
Detects non-browser processes accessing sensitive files within web browser profiles, such as credential stores (Login Data), cookies, or local storage databases (LevelDB). This behavior is indicative of credential theft and was observed in multiple modules of the StegaBin infostealer toolkit, which targeted browser-stored credentials and cryptocurrency wallet extensions.
Detects the execution of specific batch scripts (hp.bat, hpp.bat, a.bat) used by the CL-UNK-1068 actor for host reconnaissance and information gathering.
Page 19 of 30