Seb Cantar
@sebcantar0 followers6 downloads20 copies0 likes52 views
10 detections
Filters
Last updated
All Time
Detection languages
6
3
1
Categories
3
2
2
2
2
Platforms
7
3
1
Products / Services
4
3
3
1
1
MITRE Techniques
4
2
2
1
1
CVEs
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects EDR or JVM stack-trace or exception telemetry indicating the invocation of insecure deserialization methods associated with Log4jLogEvent$LogEventProxy, such as marshalledMessage.get() or MarshalledObject.get(). This pattern is indicative of potential exploitation attempts leveraging vulnerable Log4j libraries for remote code execution.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects the execution of PowerShell with obfuscated parameters such as '-WindowStyle Hidden' and '-ExecutionPolicy Bypass' in combination with network-related cmdlets (Invoke-WebRequest) or process manipulation (Start-Process). It also checks for references to common temporary file paths or 'main.exe', often indicative of malicious script execution or payload staging. The rule also includes a filter to identify if the process was initiated by common WSL or Node.js related processes.
Detects the ERAAgent.exe process creating raw sockets (SOCK_RAW) and enabling promiscuous mode (SIO_RCVALL) on a non-loopback interface while lacking corresponding listening port activity. This behavior is indicative of passive magic-packet sniffing, often associated with the SLEEPWALKER backdoor/trojan.
Detects mass deletion of files related to backups, archives, or disaster recovery across multiple distinct devices within a short timeframe. This behavior is indicative of an adversary attempting to destroy backup infrastructure to prevent system recovery following a disruptive event such as ransomware deployment.
This rule detects the presence of XMRig cryptocurrency mining binaries, including those associated with the MayaBot campaign, by inspecting file contents for characteristic strings, configuration parameters, and executable signatures.
This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.
This rule detects suspicious file downloads initiated by common browsers from a specific remote domain ('reficon.pro') associated with '/vizio.com/'. It enriches this activity by checking for prior beaconing activity to 'stats.us3.org' (often used for Matomo analytics), which may indicate a multi-stage attack where an initial profiling beacon precedes a malicious payload download.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
Detects network traffic associated with the BengalSEO campaign, specifically the retrieval of a rogue Matomo analytics script from 'stats.us3.org' and the presence of a specific Google Tag Manager ID (G-5Y9CZZF6WJ) in file traffic. This behavior is indicative of a supply chain or SEO poisoning attack aiming to track or redirect users.