Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,382 downloads1,997 copies115 likes21,640 views
436 detections
Filters
Last updated
All Time
Detection languages
350
73
9
4
Categories
179
86
56
48
42
Platforms
352
35
17
15
11
Products / Services
211
31
23
18
16
MITRE Techniques
149
115
78
48
46
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
Detects the execution of a Bumblebee loader variant which uses rundll32.exe to launch its malicious DLL. This is immediately followed by the spawning of common reconnaissance commands to gather information about the compromised system and domain. This TTP was observed in the attack chain leading to Akira ransomware.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Description: Detects the execution of a signed macOS application that subsequently spawns a script interpreter like osascript, sh, or bash. This behavior is uncommon for many legitimate GUI applications but is a known TTP for macOS malware like Odyssey Stealer, which uses signed droppers to execute malicious scripts for credential theft, persistence, and payload delivery.
Detects the creation of new scheduled tasks through Schtasks.exe, specifically those invoking OpenSSH, which could indicate an attempt to establish a reverse SSH tunnel to a remote attacker's server.
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Detects Matanbuchus Malware Loader (IOCs) including file hashes, a scheduled task name, domains, and an IP address.
Detects the creation of scheduled tasks (event ID 4698) where the task content includes references to potentially suspicious file paths and execution of known Living-off-the-Land Binaries and Scripts (LOLBAS). These behaviors are commonly associated with persistence mechanisms used by threat actors or malware.
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
KQL Query from file: Potential ClickFix Execution
Page 43 of 44