Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects network traffic consistent with RomCom's Mythic C2 framework. This includes connections to known C2 domains or requests for specific URI paths that return a 403 Forbidden status with an Nginx server header, a known fingerprint of this infrastructure.
Detects the creation or modification of scheduled tasks that execute Python scripts or masquerade as legitimate system processes. This behavior is used by threat actors in the 'Contagious Interview' campaign to establish persistence.
Detects network connections to Pastebin.com from a Python process. This behavior is associated with the InvisibleFerret malware, as part of the 'Contagious Interview' campaign, which retrieves additional payloads from Pastebin.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
Detects attempts to stop critical services like Veeam and MSSQL, a behavior associated with Cephalus ransomware to ensure successful encryption and hinder recovery.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects outbound HTTP POST requests to the LeakyStealer C2 server 'everstead.group' using a specific user-agent and URI paths.
Detects DNS queries for domains known to be associated with Clop ransomware command and control (C2) or data leak site operations.
Detects child processes spawned by "MicrosoftEdgeUpdateCore.exe" when it is located in the AppData directory. This behavior is characteristic of the LeakyStealer malware executing downloaded payloads or system commands as part of its post-exploitation activities.
Page 21 of 22