Sigma Rules
11 rules found for "Jonhnathan Ribeiro"
ZxShell Malware
Detects a ZxShell start by the called and well-known function name
Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
WannaCry Ransomware Activity
Detects WannaCry ransomware activity
Sofacy Trojan Loader Activity
Detects Trojan loader activity as used by APT28
OceanLotus Registry Activity
Detects registry keys created in OceanLotus (also known as APT32) attacks
OilRig APT Activity
Detects OilRig activity as reported by Nyotron in their March 2018 report
OilRig APT Registry Persistence
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
OilRig APT Schedule Task Persistence - Security
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
OilRig APT Schedule Task Persistence - System
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Exploiting SetupComplete.cmd CVE-2019-1378
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Formbook Process Creation
Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.