Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects the creation of 'format-results.txt' on a system, which is used by the malicious GitHub Actions workflow injected by the Checkmarx worm to store serialized GitHub repository secrets.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects network connections to known malicious infrastructure domains and IP addresses associated with the Checkmarx supply chain compromise. The compromised KICS images and mcpAddon.js payload use these hardcoded endpoints to exfiltrate stolen credentials and tokens.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects Python executables spawning shell interpreters such as cmd.exe or powershell.exe. This activity is indicative of the SNOWBASIN local HTTP bindshell proxying and executing remote commands on the host system on behalf of the attacker, as observed in UNC6692 campaigns.
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
Detects registry modifications aimed at disabling critical Windows utilities (Task Manager, Registry Editor) or degrading the user interface (swapping mouse buttons, hiding desktop icons). These behaviors are indicative of the CrystalX 'Rofl' prankware and disruption module.
Detects the execution of the 'ChromeElevator' component, which is explicitly staged and utilized by the CrystalX RAT to extract and harvest credentials from Chromium-based web browsers.
Detects potential SMS phishing (smishing) vectors involving a specific shortened URL used to deliver mobile surveillance and exfiltration malware, specifically the fake RedAlert application.
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Page 8 of 30