Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects legitimate Windows processes, known to be targeted by Dohdoor for process hollowing, making outbound network connections. This is highly indicative of the injected Dohdoor payload communicating with its C2 server.
Detects non-browser processes that spawn the WebView2 process (msedgewebview2.exe) which subsequently makes network connections to known AI platforms like copilot.microsoft.com or grok.com. This behavior is indicative of malware using an embedded browser for covert Command and Control (C2) communications, as described by Check Point Research.
Identifies processes that first communicate with AI services and then perform a low-volume burst of file creation or deletion events. This behavioral pattern may indicate an AI-driven ransomware or wiper attack that is surgically targeting key data to evade traditional volume-based detection methods, as theorized by Check Point Research.
Detects a Microsoft Office application creating script files with GUID-like names in the user's profile directory. This is the primary method used by the "Operation MacroMaze" macro to drop its initial set of malicious scripts onto the victim's machine.
Detects the execution of msiexec.exe to install an MSI package with a naming convention characteristic of the GS7 threat actor. GS7 uses specific, automated naming conventions for their malicious RMM installers, such as 'em_[8 alphanumeric]_installer' or 'Win_[18-20 digits]_installer'.
Detects DNS queries for subdomains that match a specific pattern used by the threat actor GS7. The actor uses a semi-automated infrastructure with highly specific subdomain naming conventions, such as 'rss.[random]-auth.com' or 'cpcalendars.[random]-verify.online', to host phishing pages and payloads.
Detects the legitimate Windows utility 'attrib.exe' initiating outbound network connections to common SMTP ports. This behavior is highly anomalous as attrib.exe is used to modify file attributes and should not be making network connections. The Mispadu banking trojan is known to inject its code into attrib.exe and use it to self-propagate by sending phishing emails.
Detects the creation of a scheduled task named "TPMProfiler" that executes QEMU ('qemu-system-x86_64.exe'). This technique was observed being used by threat actors to establish persistence after exploiting SolarWinds Web Help Desk vulnerabilities.
Detects the PowerShell download cradle used by the Marco Stealer malware.
Detects network traffic indicative of the Diaoyu Loader downloading second-stage payloads from GitHub. The loader masquerades these payloads as image files within a WordPress-like directory structure.
Page 22 of 30