Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects the hidden PowerShell command used by the observed Guildma Startup shortcut to launch a renamed AutoIt interpreter and a compiled script disguised as a LOG file from a user-writable public cache directory.
Detects an AutoIt interpreter executing outside the usual AutoIt installation directories. Identification uses either the normal executable name or the AutoIt code-signing publisher, allowing Cortex XDR to identify many renamed copies without relying on the unsupported OriginalFileName Sigma field.
Detects processes executing from user-writable locations connecting to TCP 8443, a behavior reported for the BraZetsu WebSocket backdoor.
Detects PowerShell launching the exact remote script URL shown in the Exvicy ClickFix report.
Detects attempts to discover domain controllers using various fallback methods, including nltest, PowerShell commands, and environment variable queries. These techniques are often employed by attackers to map the network and identify critical infrastructure.
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.
Detects PowerShell commands using the call operator with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.
This rule detects the execution of 'hh.exe' (Microsoft HTML Help Executable) specifically when it is used to open '.chm' (Compiled HTML Help) files. Adversaries often abuse 'hh.exe' to execute malicious code embedded within CHM files as a defense evasion technique, leveraging a legitimate system binary to proxy execution.
dirty frag
Sigma
This rule detects a multi-stage potential local privilege escalation attack sequence (often associated with Dirty Frag TTPs) where an ELF binary is created in a user-controlled or temporary directory, subsequently executed, and finally initiates a 'su' process.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Page 3 of 6