Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects HTTP requests containing the custom 'X-Hacked-By' header with the value 'Nexus Team . Exploited By Erratic', which is associated with the Nexus Team's exploitation of CVE-2024-3721 against TBK DVR devices. This rule specifically looks for the unique header pattern used by this threat actor.
Detects file creation or modification events targeting /etc/systemd/system/persist.service, or the execution of 'systemctl enable persist'. This persistence mechanism is used by the Nexcorium Mirai variant to ensure the botnet survives reboots.
Detects potential JabGopher activity where svchost.exe is spawned by an anomalous parent process for injection. This behavior aligns with the GopherWhisper APT execution chain, specifically injecting the LaxGopher backdoor.
This rule detects the staging or execution of the LaxGopher payload, disguised as 'whisper.dll', by monitoring DLL loading and file writing events. It specifically looks for the filename 'whisper.dll' in ImageModuleLoad, PeFileWritten, or NewExecutableWritten events.
Detects the use of the Enable-WindowsOptionalFeature cmdlet to reactivate the deprecated and vulnerable SMB1Protocol. Attackers use this to facilitate lateral movement to legacy systems.
Detects Microsoft Edge launching in headless mode and loading an unpacked extension. This technique is utilized by UNC6692 to maintain persistence and execute the SNOWBELT malicious browser extension without user visibility.
Detects the execution of a specific command line utilizing tasklist and taskkill to identify and terminate msedge.exe processes that do not have CoreUIComponents.dll loaded. This defense evasion technique is heavily utilized by UNC6692 via scheduled tasks to clean up headless Microsoft Edge processes executing their SNOWBELT malware.
Detects command-line activity associated with the execution of the Checkmarx compromise payload (mcpAddon.js), which systematically attempts to dump tokens from gh, gcloud, az, and azd CLI tools.
Detects process execution originating from the C:\ProgramData\log\ directory. This specific path is utilized as a staging directory by UNC6692 to execute their SNOWGLAZE tunneler and SNOWBASIN bindshell malware payloads.
Detects Windows Task Manager (taskmgr.exe) requesting access to the Local Security Authority Subsystem Service (LSASS) process to dump memory. This Living-off-the-Land (LotL) technique was utilized by UNC6692 to extract credentials for subsequent pass-the-hash attacks against domain controllers.
Page 7 of 30