Tag: Threat Hunting Content

Threat Hunting Content: Suspicious Execution Place
Threat Hunting Content: Suspicious Execution Place
  • May 08, 2020

Most of the rules published on the Threat Detection Marketplace are aimed at detecting attacks on Windows systems. This is not surprising since most of the threats specifically targeted at the Microsoft operating system, as it is the most popular. But there are serious threats for other operating systems, so today we will tell you […]

Read More
Threat Hunting Content: Uncover Bladabindi Backdoor
Threat Hunting Content: Uncover Bladabindi Backdoor
  • April 30, 2020

Bladabindi backdoor has been known since at least 2013, its authors monitor cybersecurity trends and improve backdoor to prevent its detection: they recompile, refresh, and rehash it, so IOCs-based detection content is almost useless. In 2018, the Bladabindi backdoor became fileless and was used as a secondary payload delivered by njRAT / Njw0rm malware. The […]

Read More
Threat Hunting Content to Spot Traces of Buer Loader
Threat Hunting Content to Spot Traces of Buer Loader
  • April 27, 2020

New community rule by Ariel Millahuel that enables detection of Buer loader is available on Threat Detection Marketplace: https://tdm.socprime.com/tdm/info/5F93tXFdZmx9/ Buer is a modular loader that was first spotted at the end of last summer and since then this malware has been actively promoted on the underground marketplaces. Proofpoint researchers tracked multiple campaigns spreading Buer loader, […]

Read More