Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,382 downloads1,997 copies115 likes21,638 views
436 detections
Filters
Last updated
All Time
Detection languages
350
73
9
4
Categories
179
86
56
48
42
Platforms
352
35
17
15
11
Products / Services
211
31
23
18
16
MITRE Techniques
149
115
78
48
46
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects non-browser processes connecting to rolimons.com along with other specified services (Discord, food delivery services, or Gmail), or creating a specific evidence file associated with order theft/infostealer behaviors (ubereats_orders.json).
Detects a remote source IP address generating a high volume of failed Remote Desktop Protocol (RDP) logon attempts across multiple Windows hosts, followed by a successful RDP logon from the same source IP.
Detects potential lateral movement or remote code execution where a file (.exe, .dll, .dat, .msi) is written via SMB from a remote source IP, followed closely by WMI execution (WmiPrvSE.exe) spawning cmd.exe or powershell.exe referencing ADMIN$ shares and output redirection.
Detects an unsigned or suspicious process touching multiple credential or session stores (such as browsers, mail clients, chat applications, SSH keys, and cloud/VPN configurations) across different categories within a short time window, indicative of infostealer or credential harvesting activity.
Detects the loading of an unsigned or non-standard DLL into the Local Security Authority Subsystem Service (LSASS) process, correlated with the same device registering that DLL as a Security Package or Authentication Package via the Windows Registry or API.
Detects a behavioral chain associated with CopperDragon activity, combining admin account creation or modification mentioning admin$, Lanman service configuration for autostart, inbound TCP port 445 firewall rule creation via netsh, and modification of the LocalAccountTokenFilterPolicy registry key.
Detects potential staging and execution activity where utilities such as expand, xcopy, or attrib referencing .rels.log files are followed by the launch of HTML Help Workshop (hhc.exe) from a temporary directory within a short time window, optionally correlated with ftp.exe command execution.
Detects a sequence where a process persisted under the WindowsUpdateAssist Run key spawns cmd.exe to execute reconnaissance commands such as 'dir' and 'systeminfo' within a 30-minute window.
Detects potential Wi-Fi profile plaintext key dumping by monitoring for a sequence where a non-network-management process runs netsh to list wireless profiles followed quickly by a request to display the profile with clear keys (key=clear).
Detects indicators of DarkWire proxy staging by identifying the creation of a netsh firewall rule named 'ss1' or the execution of csrss.exe or vmtoolsd.exe from non-standard directory paths (often associated with SoftEther proxy staging).
Page 1 of 44