Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,278 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
Detects PowerShell execution (powershell.exe or pwsh.exe) containing a URL with a decimal-encoded IPv4 host combined with common download cmdlets or .NET download methods, indicative of loader staging or ClickFix campaigns.
Detects LegionLoader (Satacom/CurlyGate) malware communicating with command and control servers via HTTP POST requests to /nfront.php or /nback.php, or via form-urlencoded POST requests originating from non-browser executables using WinHTTP.
Detects 7zr.exe, 7z.exe, or 7za.exe launched by a shell process (PowerShell, Cmd) using a password extraction switch (-p) and output directory, followed within 10 minutes by the execution of a new binary from within that user-writable extraction directory.
Detects a process launched by msiexec.exe or WixShellExec from a user-writable install path (%LOCALAPPDATA%\Programs) that subsequently loads an unsigned DLL from its own application directory within a short time window.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
Detects a network connection to potentially malicious infrastructure or non-standard ports following a request to ipify.org, which is commonly used for external IP reconnaissance by malware and C2 frameworks.
Pycodevx Rat C2 Beacon
YARA-L
Detects outbound HTTP(S) requests carrying the 'pyCodeVx', 'pyCodeV3', 'pyCodeV4', or 'NEWW' string marker in the URI, User-Agent, headers, or body, indicating beaconing by the pyCodeVx Python-based RAT (and its variants) to its command-and-control infrastructure
Detects processes attempting to open a handle to the Local Security Authority Subsystem Service (LSASS) process with read-capable access rights (0x1010 or 0x1410). These access rights are commonly associated with credential dumping tools like Mimikatz, which read LSASS process memory to extract credentials. Legitimate system processes such as wininit.exe and services.exe are excluded to reduce noise.
Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain
Detects the execution of MEGAsync binaries (MEGAsync.exe, MEGAupdater.exe, or MEGAsyncSetup64.exe) from suspicious locations typically used for staging (Temp, Downloads, Public folders), or the creation of MEGAsync configuration and state cache files in the local AppData directory. This pattern is consistent with an adversary setting up a legitimate cloud storage client for data exfiltration.
Page 1 of 7