Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the use of curl.exe to upload data to the anonymous file-sharing service temp.sh. This technique has been observed being used by threat actors for reconnaissance data exfiltration, notably after gaining initial access through a compromised Notepad++ updater.
Detects network traffic to or from known IP addresses associated with TA584 command and control (C2) servers and hosting infrastructure. This actor is a known initial access broker, and infections can lead to ransomware.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects network traffic to known Tier One Command and Control (C2) domains used by IPIDEA-affiliated SDKs (PacketSDK, CastarSDK, EarnSDK, HexSDK) for device enrollment and tasking.
Detects the execution of a hidden PowerShell window that uses Invoke-WebRequest to download and then execute a second-stage PowerShell script. This behavior is characteristic of the IClickFix framework's "ClickFix" social engineering tactic used to deliver malware like NetSupport RAT.
Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.
Detects the execution of the signed Microsoft App-V script 'SyncAppvPublishingServer.vbs' by a script host like wscript.exe or cscript.exe. This technique is used as a LOLBIN to proxy execution of other code, such as PowerShell, bypassing detections that focus on direct PowerShell execution or common parent-child process relationships. This was observed in a campaign delivering Amatera Stealer.
Detects the creation or modification of a browser extension's manifest.json file that overrides the default search provider to a known malicious or suspicious domain. This technique is used by extensions like 'DPS Websafe' and 'Stock Informer' for search hijacking.
Detects PowerShell commands that use aliases and wildcard matching to dynamically resolve sensitive cmdlets like Invoke-Expression or Invoke-RestMethod. This technique is used to evade static analysis and keyword-based detections and was observed in the Amatera Stealer infection chain.
Identifies Windows executable files signed by Hong Kong-based entities associated with IPIDEA's trojanized software distribution (e.g., masquerading as OneDriveSync or Windows Update).
Page 24 of 30