Renata Cardoso
@rcardososecBrazilTrusted contributorCompletionist
0 followers45 downloads245 copies24 likes1,278 views
69 detections
Filters
Last updated
All Time
Detection languages
38
24
4
2
1
Categories
21
14
10
10
9
Platforms
41
7
6
5
5
Products / Services
16
13
11
6
6
MITRE Techniques
21
17
16
15
9
CVEs
1
Detects certutil.exe invoked with -decode or -urlcache arguments, spawned by a script host (wscript.exe/cscript.exe) or an Office process, indicating LOLBin abuse for payload decode/transfer
Detects tar.exe execution referencing Node.js package content, indicating LOLBin abuse to extract a downloaded Node.js archive as part of malware staging
Detects the execution of JavaScript files via Windows Script Host (wscript.exe or cscript.exe) where the command line contains an unusually long base64-encoded string. This pattern is often indicative of a dropper or loader script deobfuscating and executing a subsequent malicious payload in memory.
Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.
Detects a script host process (wscript.exe/cscript.exe) making a network connection followed by that same script host spawning a child process on the same host, consistent with a RAT retrieving and executing attacker-supplied code after establishing a C2 beacon
Detects JavaScript dropper stage instantiating ActiveXObject('WScript.Shell'), ActiveXObject('Scripting.FileSystemObject'), or ActiveXObject('Shell.Application') to gain filesystem and shell command execution access, executed via wscript.exe/cscript.exe
Detects execution of expand.exe to extract an embedded Microsoft Cabinet (.cab) file, consistent with multi-stage malware payload extraction
This rule detects potential ransomware activity by monitoring for specific PowerShell commands associated with file encryption (AES, CreateEncryptor, TransformFinalBlock) and suspicious file manipulation patterns, such as mass renaming of files with common ransomware extensions or the dropping of known ransom note filenames.
Detects the execution of an executable file stored within an NTFS Alternate Data Stream (ADS) on Windows systems. The rule correlates a process launch from a file path containing an ADS colon syntax with the creation of an anomalous file in the Windows Prefetch directory that masquerades as common image or text file types (png, jpg, jpeg, txt, dat). This behavior is characteristic of adversaries attempting to hide malicious binaries in ADS while interfering with or manipulating system forensic artifacts.
Detects a suspicious sequence of events where a non-standard process writes to the Windows Installer TempPackages registry key, followed by the msiexec.exe process running as SYSTEM deleting the C:\Config.Msi folder. This behavior is indicative of potential privilege escalation or exploitation, such as CVE-2025-27727, where an attacker leverages msiexec's high-privilege context to perform unauthorized file operations.
Page 3 of 7