Marcus Mingo
@meeengoh2 followers276 downloads151 copies25 likes1,923 views
19 detections
Filters
Last updated
All Time
Detection languages
14
5
Categories
18
2
2
2
1
Platforms
19
1
1
Products / Services
11
6
4
3
1
MITRE Techniques
15
14
12
7
5
Detects Windows Script Host (wscript.exe) or masquerading binaries executing JavaScript (.js) files from user-writable paths such as C:\Users\ or C:\ProgramData\. This behavior is commonly associated with phishing payloads, malware droppers, or persistence mechanisms that execute user-space scripts. The rule covers both legitimate wscript.exe and renamed or spoofed variants.
Detects mshta.exe or masquerading binaries executing HTA files (.hta) from user-writable paths such as C:\Users\.
Threat actors leverage mshta for proxy execution or to launch malicious HTA payloads stored under user profiles.
Threat actors leverage mshta for proxy execution or to launch malicious HTA payloads stored under user profiles.
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
Detects potentially rogue or self-hosted ConnectWise Control (ScreenConnect) session launches based on suspicious query string patterns in the command line. Specifically flags sessions that include parameters like `e=...&y=...&h=...&p=...` but where the `h=` (host) value does not include common trusted TLDs. May indicate use of unauthorized remote access tools.
Investigative Tip: Sandboxing or running the strings command against the binary will reveal the embedded host parameter if you really want to be sure.
Investigative Tip: Sandboxing or running the strings command against the binary will reveal the embedded host parameter if you really want to be sure.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Generic rule content from file: Masquerade - Suspicious ScreenConnect Install
Generic rule content from file: Initial Access - Probable Rogue ScreenConnect Session
Detects suspicious use of Add-MpPreference via PowerShell where exclusions are added to Users or Temp directories — common evasion technique to bypass Defender scans.
Detects suspicious usage of PowerShell making outbound web requests initiated by the IIS Worker Process (w3wp.exe), which may indicate webshell activity or post-exploitation behavior through living-off-the-land techniques. This rule specifically looks for `Invoke-Expression`, `Invoke-WebRequest`, or `Invoke-RestMethod` patterns when launched from w3wp.exe and not by the NT AUTHORITY account.
Page 2 of 2