Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects PowerShell downloading a batch file (.bat) into the user's Startup folder. This is a common persistence technique (T1547.001) and was observed in an AsyncRAT campaign where the payload was downloaded from a malicious `trycloudflare.com` domain.
Detects the execution of a Python script from a non-standard user directory, using command-line parameters consistent with a tool used for Asynchronous Procedure Call (APC) injection. This specific command was observed in an AsyncRAT campaign where a script named 'ne.py' was used to inject a payload ('new.bin') into the explorer.exe process.
Detects commands accessing a remote WebDAV share hosted on a trycloudflare.com domain. This technique has been observed in AsyncRAT campaigns where a malicious Internet Shortcut (.url) file initiates the connection to download and execute further payloads.
Detects the use of PowerShell to download and/or expand a Python environment from the official python.org website. This technique has been observed in AsyncRAT campaigns to stage a legitimate interpreter for executing malicious Python code, bypassing defenses that might block known malicious executables.
Detects a specific DLL side-loading pattern used by APT37 in the "Operation Artemis" campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is dropped into the %TEMP% directory along with a malicious 'version.dll'. The legitimate process is then executed, causing it to load the malicious DLL.
Detects the renaming of VMware virtual machine related files to a new file ending with the '.emario' extension. This behavior is characteristic of the RansomHouse 'Mario' encryptor.
Detects network traffic to domains associated with the TAG-160 cluster's phishing campaigns, which primarily target the logistics sector.
Detects indicators of compromise (IOCs) associated with the GOLD BLADE threat group's July 2025 campaign, including file hashes and C2 domains.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
Detects the presence of malicious Microsoft Edge add-on IDs associated with the ShadyPanda campaign. These extensions are part of an active spyware operation affecting millions of users by exfiltrating browsing history, search queries, and other sensitive data.
Page 28 of 30