Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects Windows Installer executing an MSI package from ProgramData, matching the msaRAT delivery chain in which update_ms.msi is downloaded to that directory and then executed.
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
This rule goes after the behauviour of a variant of REMCOS, a remote access trojan (RAT) that has been observed in the wild.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
(Part 1 of a Correlation) Detects the creation of a potentially executable or script file by a browser or Microsoft Office application.
This rule is intended to be used in a correlation with a subsequent process execution.
This rule is intended to be used in a correlation with a subsequent process execution.
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects a DLL loaded into msiexec.exe that exports a function named RUN and exhibits Tokio async-runtime initialization behavior, reading the TOKIO_WORKER_THREADS environment variable and/or calling GetSystemInfo followed by multiple CreateThread calls to size its worker thread pool. Matches msaRAT behavior where the malicious Rust/Tokio DLL is loaded via an MSI custom action running under msiexec.exe.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
Page 1 of 6