Nicholas Gotzman

@ng15
0 followers0 downloads13 copies5 likes161 views

5 detections

ClickFix PNG steganography extraction via certutil/findstr piped to PowerShell

KQL
KQL Query
Nicholas Gotzman@ng15
avatar
Detections.ai Community
3 months ago
206

Astaroth Spambot Launches Headless WebDriver with Copied Browser Profile

KQL
KQL Query
Nicholas Gotzman@ng15
avatar
Detections.ai Community
3 months ago
4010

Astaroth Spambot WhatsApp Contact-Grabber JS Execution via WebDriver execute/sync

KQL
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Nicholas Gotzman@ng15
avatar
Detections.ai Community
3 months ago
209

CountLoader GoogleUpdateService scheduled task Python persistence

KQL
KQL Query
Nicholas Gotzman@ng15
avatar
Detections.ai Community
3 months ago
202

Astaroth Spambot Mass WhatsApp Send via sendTextMessage/sendFileMessage ZIP Injection

KQL
KQL Query
Nicholas Gotzman@ng15
avatar
Detections.ai Community
3 months ago
205