Luís Marques
@remotecodeexecutionLisbon, PortugalCompletionist
1 follower58 downloads6 copies0 likes161 views
58 detections
Filters
Last updated
All Time
Detection languages
58
Categories
39
7
4
3
2
Platforms
54
3
2
1
1
Products / Services
45
38
3
1
1
MITRE Techniques
25
19
14
13
11
CVEs
1
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects web traffic indicating client-side injection loading JavaScript from the known malicious domain hello-mywordl.info, which is associated with a WordPress malware campaign.
Detects rundll32.exe being launched via a start /min command from a script located in the AppData directory, which then loads a non-standard DLL. This behavior is often associated with malware that uses rundll32 to execute malicious code while attempting to minimize visibility by running the process in a minimized window.
Detects the execution of 'tasklist.exe' with command line arguments that enumerate running processes associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'tasklist.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects cmd.exe invoked with '/c move' relocating a downloaded payload into a timestamp-named appdata folder, consistent with a Lampion scheduled-task move stage.
Detects when rundll32 runs with the "jangadeiro" argument from the AppData directory.
The rule attempts to locate the use of the DLL from the lampion RAT to intercept browser credential operations, this is one of credentials theft techniques by Lampion.
Detects MsMpEng.exe writing executables or libraries into System32 or SysWOW64 directories, which can be indicative of junction-redirected remediation abuse.
Page 6 of 6