75ec47e99a
add new detections, story and other cool things
2025-07-01 23:04:48 +02:00
c4982909ad
diskwiper
2025-06-27 09:44:32 +02:00
4d9f9be0d6
diskwiper
2025-06-27 09:40:18 +02:00
252da8d1ef
Updated links in story yamls
2025-06-24 11:27:39 -05:00
cb45d9d030
quick fixes and updates
2025-06-17 20:32:55 +02:00
3f3763176b
Merge branch 'develop' into innoloader
2025-06-17 10:56:19 -07:00
25617e6770
Initial remote employment fraud detections.
2025-06-12 14:43:59 -04:00
f8727cdbab
innoloader
2025-05-26 11:01:31 +02:00
3c475d25c8
innoloader
2025-05-26 10:28:31 +02:00
2978bc82a1
Merge branch 'develop' into captcha
2025-05-19 12:35:22 -06:00
4bca49f239
CAPTCHA if you Can
...
## New Analytic Story
- Fake CAPTCHA Campaigns
## New Analytics
- Windows PowerShell FakeCAPTCHA Clipboard Execution
Tagged others related
2025-05-19 12:08:58 -06:00
dfac5c5239
xworm
2025-05-08 11:00:32 +02:00
cc57496610
add analytic story
2025-05-05 15:05:24 +02:00
074d13f001
BasketNetWeaving with Haag: No Shell Left Behind!
2025-04-28 10:33:17 -06:00
a219deb751
Merge branch 'develop' into water
2025-04-21 10:25:16 -07:00
067eb13fe1
Merge branch 'develop' into dep_cli
2025-04-18 13:48:27 -07:00
93a1b752fe
updating this detection
2025-04-18 13:35:11 -07:00
bb2045cce0
Merge branch 'develop' into crushingit
2025-04-18 12:45:18 -07:00
614721e681
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:26:39 -07:00
aa3187d61e
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:13:12 -07:00
949b59900f
Merge branch 'develop' into water
2025-04-18 10:11:56 -07:00
9ae046285e
Merge branch 'develop' into cactus
2025-04-18 09:52:02 -07:00
8ca79f3f56
Merge branch 'develop' into cactus
2025-04-18 09:33:17 -06:00
eae0a4ed66
updating spls to match with output from data sources
2025-04-17 14:49:05 -07:00
5e6418ee6e
Merge branch 'develop' into aws_bedrock
2025-04-17 14:24:55 -07:00
8e6d4c69bf
Merge branch 'develop' into remove_v5.4.0
2025-04-17 12:00:27 -07:00
e913143339
Water Gamayun
2025-04-17 11:26:37 -06:00
bc6635d225
Merge branch 'develop' into storm
2025-04-17 10:04:45 -07:00
96f7490cde
Merge branch 'develop' into remove_v5.4.0
2025-04-17 09:15:53 -07:00
b0f1eaa08e
Merge branch 'develop' into storm
2025-04-17 09:10:45 -07:00
c4bca6ff3b
Merge branch 'develop' into earth
2025-04-17 08:58:49 -07:00
657ffbc9e4
Ground Control to Major Haag: Earth Alux
...
This PR adds a new analytic story for the Earth Alux threat actor, a sophisticated espionage group targeting government, technology, and telecommunications sectors in APAC and Latin America.
2025-04-16 21:55:12 -06:00
8a5556b252
The Haag Identity: Storm-2460 CLFS Zero Day
...
This PR adds comprehensive detection coverage for the Storm-2460 CLFS zero-day exploitation campaign.
Changes include:
- New analytic story documenting the full attack chain
- Tagged 17 existing detections with the story
- Coverage for MSBuild abuse, CertUtil usage, and system recovery tampering
The story covers the complete attack lifecycle from initial CLFS driver exploitation through ransomware deployment, with detections for:
- MSBuild execution and renaming
- CertUtil download and decode operations
- ProcDump credential theft
- System recovery disabling (bcdedit, wbadmin)
- Event log clearing (wevtutil)
2025-04-16 21:25:23 -06:00
bf3fe8b361
remove yamls and update mapping
2025-04-15 15:19:48 -07:00
fc81c76727
Haag's Crushed Shell: A Tale of CrushFTP Exploitation
...
CVE-2025-31161
2025-04-14 12:39:07 -06:00
b6b55499db
Merge branch 'develop' into aws_bedrock
2025-04-09 14:38:00 -07:00
953c8d59da
Merge branch 'develop' into csftd_first_batch
2025-04-09 16:34:47 +02:00
53e3105db8
Merge branch 'develop' into csftd_first_batch
2025-04-03 20:59:14 +02:00
49d75bbc36
Merge branch 'develop' into firewall_win_events
2025-04-03 10:44:21 -07:00
f39a6d9a50
cisco secure firewall detections - first batch
2025-04-03 14:21:27 +02:00
50ad208b2c
Merge branch 'develop' into cactus
2025-04-02 14:50:43 -07:00
ae45debc8b
Merge branch 'develop' into firewall_win_events
2025-04-02 14:47:40 -07:00
43abc9471f
Merge branch 'develop' into medusa_ransomware
2025-04-02 14:28:10 -07:00
70a04d7ca0
Merge branch 'develop' into firewall_win_events
2025-04-02 13:23:42 -07:00
0d93ce9c0b
updating conflicts
2025-04-02 13:18:06 -07:00
0d831661a6
updating detections with conflicts
2025-04-02 11:41:46 -07:00
f8d1d71db9
Merge branch 'develop' into medusa_ransomware
2025-04-02 11:22:19 -07:00
b5a7ce9852
Merge branch 'develop' into cactus
2025-04-02 10:16:35 -06:00
f03979077a
Merge branch 'develop' into rceattack
2025-04-01 15:47:23 -07:00
a679c2e510
Merge branch 'develop' into medusa_ransomware
2025-04-01 14:52:23 -07:00
Nasreddine Bencherchali