Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the creation of 'vector_notice.sh' in '/etc/profile.d/', a shell script dropped by VECT ransomware on Linux systems to display its ransom note upon user login. This rule specifically looks for file creation events on Linux systems where the target file name matches the exact path '/etc/profile.d/vector_notice.sh'.
Detects execution of shell commands interacting with busybox (e.g., 'cat /bin/busybox'). This behavior is used by the Nexcorium Mirai variant to verify shell functionality after a successful Telnet brute-force attack.
Detects command lines associated with installing AnyDesk silently to run on startup or setting an unattended access password. Affiliates of The Gentlemen ransomware and other threat actors use this as a persistent fallback remote access channel.
Detects DNS resolution requests for the known Nexcorium C2 domain. The Nexcorium Mirai variant relies on this command-and-control server to receive attack parameters for large-scale DDoS campaigns.
Detects DNS requests to file.io originating from non-browser processes, indicative of data exfiltration, potentially by tools like CompactGopher. The rule identifies DNS requests for file.io or its subdomains, joins them with process information, and then filters out common web browsers to highlight suspicious activity.
Detects the creation of an executable file named 'sysd' in the '/usr/local/bin/' directory on Linux systems. The Nexcorium Mirai variant copies itself to this location to masquerade as a legitimate system process for persistence. This specific file name is not a standard Linux system daemon.
Detects command-line registry modifications that explicitly enable anonymous LSA enumeration. This action can lower the environment's security posture and aid in internal network discovery, a technique observed in operations like The Gentlemen RaaS.
Detects the use of the Add-MpPreference cmdlet to add the root C:\ drive to the Windows Defender exclusion path. Attackers and ransomware families, such as The Gentlemen, use this technique to completely blind Windows Defender to malicious file activity during the encryption process.
Detects the use of esxcfg-advcfg to alter the BufferCache settings (MaxCapacity or FlushInterval) on an ESXi host. This activity is often associated with ransomware variants like Gentlemen ransomware, which modify these settings to prepare the storage layer for fast, reliable bulk file encryption.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Page 6 of 30