admin/boku7-Loki
1
0
Fork 0
mirror of https://github.com/boku7/Loki synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source 
added sigma to detect hijack of Electron's app folder (Teams, VS Code, RingCentral, Postman) to load C2 framework
This commit is contained in:
4y45u45c4
2025-04-12 19:28:08 +02:00
committed by GitHub
parent bb5f9cb3e2
commit 2cf1c7beb6
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -242,6 +242,7 @@ I do not recommend compiling the agent and using it for operations. Agent compil
- IOC: `%LOCALAPPDATA%\Microsoft\Teams\current\app` directory created
- IOC: `%LOCALAPPDATA%\Microsoft\Teams\current\app.asar` file created/modified by non-Teams installer/updater
- [SIGMA rule](https://github.com/4y45u45c4/SIGMA/blob/main/loki_c2_channel_established_from_electron_app.yaml) to detect established Loki C2 from electron app
- [SIGMA rule](https://github.com/4y45u45c4/SIGMA/blob/main/hijack_of_electron_app_to_load_C2_framework.yaml) to detect hijacking of Electron's app folder (Teams, VS Code, RingCentral, Postman) to load C2 framework
# References || Acknowledgements || Offensive Electron Research