1 match for rule TAIDOOR - Chinese RAT by Ariel Millahuel from SOC Prime Threat Detection Marketplace
This RAT was discovered by CISA. Taidoor is installed on a target’s system as a service dynamic link library (DLL) and is comprised of two files. The first file is a loader, which is started as a service. The loader decrypts the second file, and executes it in memory, which is the main Remote Access Trojan (RAT).
View rule View matches
53 matches for rule Nibiru detection (Registry event and CommandLine parameters) by Ariel Millahuel from SOC Prime Threat Detection Marketplace
The NIBIRU ransomware encrypts the victim’s files with a strong encryption algorithm until the victim pays a fee to get them back. It's seems to be that a new variant family of NIBIRU ransomware [NIBIRU.RSM] is actively spreading in the wild.
View rule View matches
1 match for rule K8h3d campaign (Sysmon detection) by Ariel Millahuel from SOC Prime Threat Detection Marketplace
The k8h3d attack campaign combines a Monero cryptominer and a worm module which exploits EternalBlue to gain lateral movement.
View rule View matches
2 matches for rule Disable of ETW Trace by @neu5ronFlorian Roth, Jonhnathan Ribeiro, oscd.community from Sigma Integrated Rule Set (GitHub)
Detects a command that clears or disables any ETW trace log which could indicate a logging evasion.
View rule View matches
4 matches for rule File deletion via CMD (via cmdline) by Ariel Millahuel from SOC Prime Threat Detection Marketplace
Detects "cmd" utilization to self-delete files in some critical Windows destinations.