Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Tycoon2FA Infrastructure IP Connections
Cortex XDR
Detects network traffic to IP addresses confirmed to host Tycoon2FA post-takedown components, including link management, credential harvesting, and kill switch infrastructure.
Tycoon2FA Malicious S3 Lure Access
Cortex XDR
Detects DNS queries pointing to a specific malicious AWS S3 bucket URL known to be utilized by the Tycoon2FA threat actor for hosting initial cloned Microsoft Power Pages lures. This rule identifies network activity attempting to resolve this highly specific Indicator of Compromise (IOC).
Detects the creation of the specific named pipe 'GreenPlasmaSystemPipe' used for SYSTEM token impersonation. This is an explicit Indicator of Compromise (IOC) from the default GreenPlasma payload.
Detects unauthorized or unexpected modifications setting DisableLockWorkstation to 1 in the HKCU Policies path. This modification is explicitly used in the GreenPlasma exploit chain to retain interactive workstation access once SYSTEM execution is achieved.
Detects unexpected DACL modifications on critical policy keys (CloudFiles or System Policies). Relaxing these DACLs allows unprivileged actors to write values like DisableLockWorkstation, maintaining exploit persistence.
CloudFiles BlockedApps Registry Symlink
Cortex XDR
Detects registry key creation under CloudFiles\BlockedApps, indicative of the GreenPlasma exploit where attackers use a volatile registry symlink to hijack the CloudFiles policy engine. This technique can be used for privilege escalation.
Detects the creation of an NT Object Manager symbolic link pointing to CTF.AsmListCache.FMPWinlogon paths, indicative of GreenPlasma Stage 1. This activity is captured via Windows Security Event 4663 (Object Access) and specifically filters for 'SymbolicLinkObject' creation where the object name contains 'CTF.AsmListCache.FMPWinlogon'.
Detects ctfmon.exe calling NtCreateSymbolicLinkObject or loading cldapi.dll, which indicates the initial stages of the GreenPlasma exploit. This behavior is indicative of process injection or privilege escalation attempts.
Detects the creation of files indicative of the compromised Checkmarx AST plugin version 2026.5.09 being deployed. This rule identifies specific malicious filenames or known compromised SHA256 hashes associated with the TeamPCP backdoor.
Detects the addition of malicious RxRPC v1 tokens to the process keyring. This behavior is indicative of the RxRPC variant of the Dirty Frag Linux local privilege escalation exploit. The exploit uses the add_key syscall to plant a session key used for in-place pcbc(fcrypt) decryption, targeting privileged files like /etc/passwd.
Page 2 of 30