Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects known malware hashes associated with the Iranian APT group Seedworm (aka MuddyWater), including their Dindoor, Fakeset, Stagecomp, and Darkcomp malware families.
Detects the execution of LsaRecorder, a credential dumping tool used by CL-UNK-1068.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects the modification of the .profile file to establish persistence, a technique used by the ClipXDaemon malware. The rule looks for a command that appends the execution of a file from the `~/.local/bin` directory to the `.profile` file.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects DNS queries for domains that match the pattern used by the PLASMAGRID malware's Domain Generation Algorithm (DGA). This malware, delivered by the Coruna iOS exploit kit, uses a DGA seeded with "lazarus" to generate 15-character domains with a ".xyz" TLD for command and control fallback.
Detects the execution of `node` running scripts from a `vendor` directory during an `npm install` lifecycle. This behavior was observed in the StegaBin campaign where malicious npm packages used an install hook to execute a loader from 'vendor/scrypt-js/version.js'.
Detects network connections to known command-and-control (C2) and distribution domains associated with the Coruna exploit kit campaigns. This includes the domain used in the Ukrainian campaign by UNC6353 and the larger set from the financially motivated UNC6691 group.
Detects Indirect Prompt Injection (IDPI) attempts where malicious instructions are dynamically injected into the DOM using JavaScript or concealed within HTML data attributes. Attackers use these methods to bypass static analysis tools and deliver hidden prompts to AI/LLM agents that process raw web content.
Detects the PLASMAGRID implant and its modules by their SHA-256 hash values. The implant is the final payload of the Coruna exploit kit, designed to steal cryptocurrency and other financial information from compromised iOS devices.
Page 20 of 30