Rémi Dubois
@remidubzCompletionist
1 follower34 downloads6 copies1 like251 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
1
Platforms
2
1
1
Products / Services
1
MITRE Techniques
1
1
1
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
Detects conhost.exe launching a headless PowerShell one-liner that creates a FortiClient compliance directory, copies Chrome Cache data, reconstructs a ComplianceChecker.zip using unique markers, expands it and executes FortiClientComplianceChecker.exe — behavior observed in ClickFix-style social engineering campaigns.