Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects the execution of shell interpreters (such as cmd, powershell, bash, osascript) as child processes of the Obsidian note-taking application. This behavior was observed in the REF6598 campaign where threat actors abused the "Shell Commands" community plugin to deliver the PHANTOMPULSE RAT. It also detects specific command-line indicators associated with the campaign.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects WMI queries for installed AntiVirus products executed via scripting interpreters such as wscript.exe, cscript.exe, powershell.exe, or wmic.exe. This behavior may indicate an attempt to gather information about security software on the system, which can be a precursor to evasion or targeted attacks.
Detects the PowerShell download-and-execute method used by the Exvicy ClickFix example without relying on its domain.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
The rule attempts to find scheduled tasks being created via the "schtasks.exe" binary, when it's parent is "wscript" or "cscript".
Detects msiexec.exe launching Chrome or Edge in headless mode with a remote debugging port and a custom user-data directory, matching the browser-hijacking stage used by msaRAT.
This rule detects the Download of the stager for the msaRAT directly from the IP marked as IOC
Detects creation or overwrite of the Windows shortcut name pattern observed in the Guildma Startup-folder persistence mechanism when the creator is a script interpreter, LOLBin, or process running from a user-writable location. The Cortex XDR Sigma backend maps TargetFilename to action_file_name and cannot represent the Startup directory path; use the companion native XQL rule for path-based detection.
Page 2 of 6