Kaung Khant Ko
@kaungkhantkoTrusted contributorCompletionist
13 followers1,382 downloads1,997 copies115 likes21,639 views
436 detections
Filters
Last updated
All Time
Detection languages
350
73
9
4
Categories
179
86
56
48
42
Platforms
352
35
17
15
11
Products / Services
211
31
23
18
16
MITRE Techniques
149
115
78
48
46
CVEs
3
1
IDS Classtypes
5
2
1
1
IDS Protocols
8
3
KQL Query from file: Detection fake CAPTCHA-based clipboard hijacking
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
This rule detects suspicious creation or modification of Windows Scheduled Tasks via direct changes to the Registry, as captured by Sysmon Event IDs 12, 13, and 14. Adversaries often use this technique to establish persistence by creating malicious tasks that run at system startup or on a scheduled basis. The rule monitors the TaskCache registry paths specifically Tasks and Tree keys and excludes known legitimate operations by trusted system processes and users (e.g., taskhostw.exe, svchost.exe, SYSTEM, and service accounts) to reduce false positives.
Detects various initial access TTPs associated with the "ClickFix" attack vector, where users are tricked into running malicious commands. This includes behaviors observed in Lumma Stealer, Latrodectus, and NetSupport RAT campaigns.
KQL Query from file: Suspicious Stealer Behavior
KQL Query
Page 44 of 44