Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
Detects attempts by the TamperedChef malware to discover installed security products by querying specific registry keys. This behavior often precedes credential theft activities, which can involve terminating browser processes.
Detects files associated with various tools (GoTokenTheft, Earthworm, SharpHound, Impacket, GoExec, SharpWMI, Rubeus, Certipy) used by the UAT-8837 threat actor based on their SHA256 hashes.
Detects the creation of scheduled tasks with specific names and command lines used by the TamperedChef malware for persistence.
Detects network connections or DNS queries to command and control (C2) domains associated with the TamperedChef malvertising campaign.
Detects the download of the Amnesia RAT payload from a specific Dropbox URL observed in a multi-stage malware campaign.
Detects the execution of the TamperedChef payload 'PDF Editor.exe' from its specific, non-standard installation directories within user profiles.
Detects the execution of the RustyWater implant payload "CertificationKit.ini" from the "C:\ProgramData" directory. This activity is associated with the MuddyWater APT group.
Detects known malicious file hashes associated with the VoidLink malware framework.
Page 27 of 30