Attributed metadata history

v6.3.0

🚀 Key Highlights ⭐ Starland RAT Campaign (UAT-11795) ⭐ Expanded detection coverage for the Starland RAT campaign attributed to UAT-11795, a financially motivated threat actor leveraging ClickFix social engineering and trojanized installers to deploy Starland RAT, the WLDR Agent PowerShell memory implant, and supporting malware including CastleStealer and Remcos RAT. This release tags a broad set of existing analytics covering PowerShell abuse, malicious script execution, persistence, reconnaissance, suspicious downloads, registry modifications, and Telegram-based C2 communications, improving visibility into the multi-stage infection chain, in-memory execution, credential theft, and resilient command-and-control techniques used throughout the campaign. 👀 Linux Exploitation Detection Expansion 👀 Expanded Linux detection coverage with new analytics focused on local privilege escalation, defense evasion, and kernel-level exploitation techniques, improving visibility into attempts to bypass security controls, abuse elevated execution paths, and exploit low-level system components commonly targeted by advanced adversaries. New Analytic Story - [1] Starland RAT Campaign New Analytics - [4] Linux Apparmor Bypass Via Aaexec Linux Auditd Possible Setuid Execve Privesc Linux Pedit Offset Out Of Bounds Windows AppCertDLL Modification Via Registry Updated Analytics - [67] AWS Bedrock Claude Unusually Large Prompts Attacker Tools On Endpoint Batch File Write to System32 Cisco NVM - Curl Execution With Insecure Flags Cisco NVM - Installation of Typosquatted Python Package Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Cisco NVM - Non-Network Binary Making Network Connection Cisco NVM - Outbound Connection to Suspicious Port Cisco NVM - Rclone Execution With Network Activity Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Cisco NVM - Susp Script From Archive Triggering Network Activity Cisco NVM - Suspicious Download From File Sharing Website Cisco NVM - Suspicious File Download via Headless Browser Cisco NVM - Suspicious Network Connection From Process With No Args Cisco NVM - Suspicious Network Connection Initiated via MsXsl Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco NVM - Webserver Download From File Sharing Website Common Ransomware Extensions Common Ransomware Notes Detect HTML Help URL in Command Line Detect MSHTA Url in Command Line Detect RClone Command-Line Usage Domain Controller Discovery with Nltest Email files written outside of the Outlook directory Executables Or Script Creation In Suspicious Path LLM Model File Creation Linux Binary Launched Process with Null Argv Linux PF_ALG Registration Outside of Boot Window Local LLM Framework DNS Query Malicious PowerShell Process - Execution Policy Bypass PowerShell 4104 Hunting Recon AVProduct Through Pwh or WMI Registry Keys Used For Persistence Set Default PowerShell Execution Policy To Unrestricted or Bypass Short Lived Scheduled Task (External Contributor: @AndreiBanaru) Suspicious Process Executed From Container File Svchost LOLBAS Execution Process Spawn Time Provider Persistence Registry WMIC XSL Execution via URL Windows AppCertDLL Modification Via Command Line Windows Boot or Logon Autostart Execution In Startup Folder Windows Curl Download to Suspicious Path Windows Curl Upload to Remote Destination Windows DNS Query Request by Telegram Bot API Windows File Download Via CertUtil Windows File Download Via PowerShell Windows File Without Extension In Critical Folder Windows Gather Victim Network Info Through Ip Check Web Services Windows HTTP Network Communication From MSIExec Windows InstallUtil Remote Network Connection Windows InstallUtil URL in Command Line Windows Kerberos Local Successful Logon Windows Large Number of Computer Service Tickets Requested (External Contributor: @munzzyy) Windows Local LLM Framework Execution Windows MSI Rollback Script Deleted By Non-Msiexec Process Windows MSIEx

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.