Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects the execution of PowerShell cmdlets used to mount ISO/VHD images. This behavior is a known prerequisite for the RoguePlanet Windows Defender vulnerability exploit, which relies on a race condition triggered during the mounting of an ISO image by a standard user.
Detects the use of the Add-MpPreference PowerShell cmdlet to add the entire C:\ drive or powershell.exe to Microsoft Defender exclusions. This technique is actively used by threat actors to bypass antivirus scanning and ensure the execution of subsequent payloads.
Detects the creation of a scheduled task utilizing an XML configuration file located in the C:\Users\Public\Documents directory. The CryptoBandits worm component creates these tasks to maintain persistence for both itself and the stealer payload.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
Detects the creation or execution of the trepamobq.cmd file, which is associated with the Trepamo banking malware. This detection identifies instances where the trepamobq.cmd script is created in the filesystem or executed, which may indicate a compromise or malicious activity related to banking malware.
Detects the creation of a registry run key named 'Financeiro' under the CurrentVersion\Run path, which is associated with the Ousaban malware. This detection identifies instances where the 'Financeiro' run key is created in the Windows registry, which may indicate a compromise or malicious activity related to Ousaban malware persistence.
Detects the execution of 'reg.exe' with command line arguments that query registry keys associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'reg.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects execution of a trojanized 7-Zip proxyware payload (hero.exe/uphero.exe) from the SysWOW64 directory. This malware is known to be used in targeted attacks and can lead to unauthorized access and data exfiltration.
Page 4 of 6