Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,382 downloads1,997 copies115 likes21,639 views
436 detections
Filters
Last updated
All Time
Detection languages
350
73
9
4
Categories
179
86
56
48
42
Platforms
352
35
17
15
11
Products / Services
211
31
23
18
16
MITRE Techniques
149
115
78
48
46
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the Oyster delivery via Teams FakeApp by identifying specific HTTP request patterns, including OPTIONS/POST to /create/link and GET to /gov/ paths and
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
Identifies attempts to remove Internet Information Services (IIS) log files using command-line utilities.
Attackers who gain access to IIS-hosted applications commonly remove or truncate IIS log files to evade detection and cover post-exploitation activity. This detection looks for command-line processes (Windows CMD/PowerShell/PowerShell Core) that execute common file-deletion commands against the IIS log folder.
Attackers who gain access to IIS-hosted applications commonly remove or truncate IIS log files to evade detection and cover post-exploitation activity. This detection looks for command-line processes (Windows CMD/PowerShell/PowerShell Core) that execute common file-deletion commands against the IIS log folder.
Detects access to sensitive browser files by non-browser processes. This can indicate attempts by malware to steal credentials, cookies or other sensitive user data.
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
Detects modification of shell profile files (.zshrc, .bash_profile, .profile) by processes named 'applet' or 'qtop'. This is a fallback persistence mechanism used by the ChillyHell malware.
Detects outbound network connections to the Telegram API, a technique used by XWorm for command and control (C2) and data exfiltration. The rule specifically looks for connections to "api.telegram.org/bot" and "/sendMessage" paths, originating from suspicious processes like WmiPrvSE.exe or Soundman.exe, or from common user-writable locations.
Detects the creation of a scheduled task designed to run with SYSTEM privileges and terminate common AV/EDR processes. This technique is used by kkRAT for persistence and defense evasion.
This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").
Detects network connections to known XWorm Command and Control (C2) infrastructure (IPs and domains) and the creation of processes with filenames associated with XWorm malware. This rule combines network and process-based indicators to identify potential XWorm infections.
Page 41 of 44