Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,280 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
Detects the enabling of the WDigest UseLogonCredential registry value, which forces the storage of plaintext credentials in memory by the LSASS process, followed by a privileged interactive or remote interactive logon on the same host within 72 hours. This sequence suggests an attacker is positioning the system to harvest credentials.
Detects the creation of Windows Scheduled Tasks that reference MEGA sync client executables (MEGA, MEGAsync, MEGAupdater, MEGAcmd) from file paths outside of the expected Mega Limited installation directory. This can indicate an attempt to maintain persistence by masquerading as or hijacking a legitimate MEGA installation, even after the original application files are removed.
Detects the temporary enablement of the UseLogonCredential registry value by setting it to 1, followed by a subsequent reversion to 0 on the same host. This pattern is indicative of a deliberate 'hit-and-run' attempt to force the WDigest security package to store plaintext credentials in memory for harvesting.
Detects the use of rundll32.exe to invoke the MiniDump function from comsvcs.dll, which is a well-known technique to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to a file for credential harvesting.
Detects polymorphic multi-stage JavaScript RAT/backdoor loaders that dynamically rename variables and function headers per sample to evade signature-based detection. Identifies the malware via structural indicators that persist across renamed samples: ActiveXObject COM instantiation for filesystem/shell/explorer access, hex-indexed dynamic function resolution, and base64 decode-then-reverse deobfuscation idioms.
Detects schtasks.exe /create execution referencing task.xml or pointing to a script interpreter (wscript.exe/cscript.exe), indicating malware persistence via scheduled task
Detects wscript.exe spawning curl.exe as a child process, consistent with C2 beaconing where the malware issues an HTTPS request via curl.exe that is redirected to a secondary attacker-controlled domain
Detects execution of node.exe, which may indicate anomalous LOLBin/runtime usage on endpoints where Node.js is not an authorized business tool
This rule detects the execution or presence of known malicious JavaScript loader files identified as part of a banking-lure phishing campaign by matching their SHA256 file hashes.
Page 2 of 7