Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
Detects processes masquerading as kernel worker threads (e.g., 'kworker/*') but running in a non-root user context. This technique is used by the ClipXDaemon malware to evade detection by blending in with legitimate system processes.
Detects web content containing strings associated with destructive commands or unauthorized financial transactions, often embedded as part of an Indirect Prompt Injection (IDPI) attack. These prompts are designed to be executed by an AI agent or LLM, potentially leading to data loss, denial of service, or financial theft.
Detects network connections to Hugging Face to download a large Large Language Model (LLM) module, a technique used by the SURXRAT Android RAT to induce network lag and degrade device performance.
Detects the use of Metasploit's 'getsystem' command, which creates a temporary service that executes a command to echo data into a named pipe. This is a common technique for privilege escalation via named pipe impersonation.
Detects a node.js process spawning another node.js process to evaluate a script from the command line or stdin. This is a key technique used by malware, as referenced in the Jamf Threat Labs report on DPRK-linked actors, to execute additional payloads received from a C2 server persistently.
Detects processes associated with Dohdoor malware making network connections to Cloudflare's DNS-over-HTTPS service for C2 domain resolution.
Detects a Java process spawning a command shell to download a file using the certutil.exe utility. This behavior was observed in the exploitation of Apache ActiveMQ (CVE-2023-46604), where the threat actor used this technique to download a secondary payload.
Detects the execution of legitimate Windows executables from non-standard public directories. This is a technique used by the Dohdoor malware to sideload a malicious DLL (e.g., propsys.dll, batmeter.dll).
Detects known file hashes and C2 domains associated with the Dohdoor malware campaign. This rule combines file and network indicators; it may need to be split into two separate rules (e.g., for file events and network events) depending on the SIEM implementation.
Page 21 of 30