Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects network connections to domains known to be used as infrastructure for an ongoing, highly evasive Evilginx phishing campaign targeting SSO portals.
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
Detects the presence of malicious Google Chrome extension IDs associated with the ShadyPanda campaign. These extensions can act as a backdoor, enabling remote code execution and data exfiltration.
Query looks for indicators of malicious npm package installs related to recent Shai-Hulud campaigns since October 2025.
Detects the execution of "ClipUp.exe" with specific command-line parameters used to abuse Protected Process Light (PPL) to tamper with the Microsoft Defender process ("MsMpEng.exe"). This technique was observed in the RONINGLOADER campaign.
Detects the creation of files in a directory known to be created by a malicious NSIS installer associated with the RONINGLOADER campaign.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
Detects the execution of specific system commands used by the DigitStealer malware for anti-analysis and evasion. This includes checks for virtualization, hardware features (specifically on Apple Silicon), and system locale.
Detects the creation of a Launch Agent .plist file used by the DigitStealer malware. This Launch Agent dynamically retrieves its payload from a DNS TXT record, a technique used for resilient persistence.
Page 29 of 30