Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
Detects the creation of scheduled tasks used for persistence by fake PDF converter malware. These tasks are created in the registry under the TaskCache tree.
Detects the execution of Asterisk PBX management commands to enumerate channels or peers, originating from a web server user. This behavior is indicative of a compromised web application or web shell, such as EncystPHP, being used to inspect or hijack telephony resources.
Detects the execution of executables with names like 'Updater.exe' from suspicious paths in the AppData\Local directory, which are associated with fake PDF converter malware families like PDFClick, Easy2Convert, and ConvertMate.
Detects the creation of a specific registry run key used by the TamperedChef malware for persistence.
Detects network connections from a node.js process to a known C2 server address (87.236.177.9:3000) used by DPRK-linked threat actors.
Detects the modification of file association registry keys to hijack the default 'open' action. This technique is used by malware to prevent users from launching applications or opening files by redirecting the action to a command that displays a message, effectively causing a denial of service on the endpoint.
Detects a process chain where the Microsoft HTML Application Host (mshta.exe) launches the TamperedChef secondary payload 'ManualFinderApp.exe'.
Detects the presence and execution of Defendnot components. This tool is used to disable Microsoft Defender by exploiting the Windows Security Center trust model, which involves injecting a malicious DLL into the trusted Task Manager process.
Detects the use of 'dsquery.exe' to perform broad Active Directory user reconnaissance. Threat actors like UAT-8837 use this legitimate tool to enumerate all users in a domain to identify high-value targets.
Page 26 of 30