Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects process execution patterns associated with the Sliver adversary emulation and red team framework. This rule identifies PowerShell-based UTF-8 console encoding manipulation patterns frequently observed in Sliver C2 stagers and implants, which adjust Console OutputEncoding to UTF8 prior to command execution. Such behavior may indicate unauthorized command-and-control (C2) activity or in-memory payload staging.
Detects creation of malicious Lua script files in AppData\Roaming\Adobe\Scripts directory used in infection chain.
Detects creation of malicious files in AppData\Roaming\Bluetooth directory used for DLL sideloading in infection chain.
Detects creation of malicious files in AppData\Roaming\ProShow directory used in infection chain.
Detects curl commands uploading files to temp.sh service for data exfiltration via update.exe.
Detects gup.exe making DNS queries to domains other than legitimate Notepad++ infrastructure.
Detects DNS queries to known malicious domains used in Notepad++ supply chain attack for C2 communication and payload delivery.
Detects the execution of the Diaoyu Loader, which performs a sandbox evasion check by verifying the existence of a 'pic1.png' file in its execution directory. This behavior is associated with the TGR-STA-1030 threat group.
Detects suspicious child processes spawned by Notepad++ updater (gup.exe) including cmd.exe with reconnaissance commands or scripting engines.
Detects execution of ProShow.exe from AppData directory, indicating potential exploit delivery.
Page 17 of 22