Elgonad .
@elgonadTrusted contributor
5 followers2,566 downloads1,005 copies47 likes69,306 views
293 detections
Filters
Last updated
All Time
Detection languages
220
39
33
1
Categories
102
76
49
38
36
Platforms
153
77
55
32
10
Products / Services
31
16
13
10
8
MITRE Techniques
84
75
70
62
57
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects HTTP POST requests to specific URI paths (res.php, tele.php) commonly associated with BlobPhish credential exfiltration. This rule identifies attempts to send stolen credentials or other sensitive data to attacker-controlled endpoints.
Detects HTTP POST requests to /panel.php. This endpoint is frequently used by the BlobPhish campaign for backend C2 interaction or validation checks, often accompanied by an empty request body and a specific JSON error response.
Detects the presence of specific JavaScript functions used to generate and handle Blob objects in memory. This technique is utilized by the BlobPhish campaign to keep the phishing payload in memory, thereby evading file and network scanning.
Detects suspicious execution of wget or curl retrieving a payload named exactly '/.shell', which matches Masjesu's C2 download pattern. After successfully exploiting a target, the botnet attempts to retrieve this bash shell file to initiate device infection and propagation routines.
Detects the termination of critical administrative (sshd) and data transfer utilities (wget, curl). The Masjesu botnet commonly executes this to disrupt rival botnets and lock out administrators.
Detects the creation of crontab entries executing a payload masquerading as a legitimate Linux dynamic linker (ld-unix.so.2). Masjesu uses this highly specific path and filename combination to disguise its primary persistence mechanism.
Monitors for the specific URL pattern used by the PhantomPull loader to fetch the final PhantomPulse payload via WinHTTP. This behavior is associated with the REF6598 campaign.
Detects network connections to Masjesu's hardcoded fallback command and control IP addresses over port 443. This rule is critical for detecting mature infections where Masjesu actively falls back to a set of hardcoded IP addresses if domain resolution fails.
Detects the execution of the primary PhantomPull loader component ('syncobs.exe') before it decrypts and reflectively loads the final PhantomPulse RAT payload, as observed in the REF6598 campaign.
Page 9 of 30