Rachid O
@mrrachidCompletionist
1 follower0 downloads5 copies0 likes778 views
3 detections
Filters
Last updated
All Time
Detection languages
3
Categories
2
1
1
1
1
Platforms
1
1
1
MITRE Techniques
2
1
1
1
1
Detects PowerShell utilizing the Start-BitsTransfer cmdlet to download the 'syncobs.exe' payload, a known indicator for the PHANTOMPULL loader stage in the REF6598 campaign (PHANTOMPULSE RAT).
Detects network connections to known REF6598 staging and command-and-control infrastructure, including a hardcoded staging IP and PHANTOMPULSE panel domains. This provides a high-fidelity signal of active PHANTOMPULSE infections and potential data exfiltration attempts.
Detects the creation of the specific LaunchAgent plist file (com.vfrfeufhtjpwgray.plist) used by the macOS execution chain for persistence in the REF6598 campaign delivering PHANTOMPULSE RAT.