Skip to content

Commit 3514a3e

Browse files
patel-bhavinpatel-bhavin
authored
Merge pull request #3687 from splunk/GhostRedirector
GhostRedirectors
2 parents eb4400c + 8b20564 commit 3514a3e

File tree

42 files changed

+163
-82
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+163
-82
lines changed

‎detections/endpoint/bitsadmin_download_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: BITSAdmin Download File
22
id: 80630ff4-8e4c-11eb-aab5-acde48001122
3-
version: 12
4-
date: '2025-07-29'
3+
version: 13
4+
date: '2025-09-16'
55
author: Michael Haag, Sittikorn S
66
status: production
77
type: TTP
@@ -81,6 +81,7 @@ tags:
8181
- Flax Typhoon
8282
- Gozi Malware
8383
- Scattered Spider
84+
- GhostRedirector IIS Module and Rungan Backdoor
8485
asset_type: Endpoint
8586
mitre_attack_id:
8687
- T1197

‎detections/endpoint/certutil_with_decode_argument.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: CertUtil With Decode Argument
22
id: bfe94226-8c10-11eb-a4b3-acde48001122
3-
version: 10
4-
date: '2025-05-02'
3+
version: 11
4+
date: '2025-09-16'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -79,6 +79,7 @@ tags:
7979
- Forest Blizzard
8080
- APT29 Diplomatic Deceptions with WINELOADER
8181
- Storm-2460 CLFS Zero Day Exploitation
82+
- GhostRedirector IIS Module and Rungan Backdoor
8283
group:
8384
- APT29
8485
- Cozy Bear

‎detections/endpoint/cisco_nvm___webserver_download_from_file_sharing_website.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Cisco NVM - Webserver Download From File Sharing Website
22
id: 1984f997-3b49-4d4b-a7e9-dc5dbf88370e
3-
version: 2
4-
date: '2025-09-09'
3+
version: 3
4+
date: '2025-09-16'
55
author: Nasreddine Bencherchali, Splunk
66
status: production
77
type: TTP
@@ -86,6 +86,7 @@ drilldown_searches:
8686
latest_offset: $info_max_time$
8787
tags:
8888
analytic_story:
89+
- GhostRedirector IIS Module and Rungan Backdoor
8990
- Cisco Network Visibility Module Analytics
9091
asset_type: Endpoint
9192
mitre_attack_id:

‎detections/endpoint/detect_exchange_web_shell.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Exchange Web Shell
22
id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
3-
version: 12
4-
date: '2025-05-02'
3+
version: 13
4+
date: '2025-09-16'
55
author: Michael Haag, Shannon Davis, David Dorsey, Splunk
66
status: production
77
type: TTP
@@ -73,6 +73,7 @@ tags:
7373
- Compromised Windows Host
7474
- BlackByte Ransomware
7575
- Seashell Blizzard
76+
- GhostRedirector IIS Module and Rungan Backdoor
7677
asset_type: Endpoint
7778
mitre_attack_id:
7879
- T1133

‎detections/endpoint/detect_remote_access_software_usage_file.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage File
22
id: 3bf5541a-6a45-4fdc-b01d-59b899fff961
3-
version: 10
4-
date: '2025-07-29'
3+
version: 11
4+
date: '2025-09-16'
55
author: Steven Dick
66
status: production
77
type: Anomaly
@@ -90,6 +90,7 @@ tags:
9090
- Seashell Blizzard
9191
- Scattered Spider
9292
- Interlock Ransomware
93+
- GhostRedirector IIS Module and Rungan Backdoor
9394
asset_type: Endpoint
9495
mitre_attack_id:
9596
- T1219

‎detections/endpoint/detect_remote_access_software_usage_process.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Remote Access Software Usage Process
22
id: ffd5e001-2e34-48f4-97a2-26dc4bb08178
3-
version: 10
4-
date: '2025-07-29'
3+
version: 11
4+
date: '2025-09-16'
55
author: Steven Dick, Sebastian Wurl, Splunk Community
66
status: production
77
type: Anomaly
@@ -104,6 +104,7 @@ tags:
104104
- Seashell Blizzard
105105
- Scattered Spider
106106
- Interlock Ransomware
107+
- GhostRedirector IIS Module and Rungan Backdoor
107108
asset_type: Endpoint
108109
mitre_attack_id:
109110
- T1219

‎detections/endpoint/executables_or_script_creation_in_suspicious_path.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Executables Or Script Creation In Suspicious Path
22
id: a7e3f0f0-ae42-11eb-b245-acde48001122
3-
version: 18
4-
date: '2025-07-28'
3+
version: 19
4+
date: '2025-09-16'
55
author: Teoderick Contreras, Splunk
66
status: production
77
type: Anomaly
@@ -114,6 +114,7 @@ tags:
114114
- Interlock Ransomware
115115
- Interlock Rat
116116
- NailaoLocker Ransomware
117+
- GhostRedirector IIS Module and Rungan Backdoor
117118
asset_type: Endpoint
118119
mitre_attack_id:
119120
- T1036

‎detections/endpoint/headless_browser_mockbin_or_mocky_request.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Headless Browser Mockbin or Mocky Request
22
id: 94fc85a1-e55b-4265-95e1-4b66730e05c0
3-
version: 7
4-
date: '2025-05-02'
3+
version: 8
4+
date: '2025-09-16'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP
@@ -65,6 +65,7 @@ rba:
6565
tags:
6666
analytic_story:
6767
- Forest Blizzard
68+
- GhostRedirector IIS Module and Rungan Backdoor
6869
asset_type: Endpoint
6970
atomic_guid: []
7071
mitre_attack_id:

‎detections/endpoint/lolbas_with_network_traffic.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: LOLBAS With Network Traffic
22
id: 2820f032-19eb-497e-8642-25b04a880359
3-
version: 11
4-
date: '2025-05-26'
3+
version: 12
4+
date: '2025-09-16'
55
author: Steven Dick
66
status: production
77
type: TTP
@@ -74,6 +74,7 @@ tags:
7474
- Living Off The Land
7575
- Malicious Inno Setup Loader
7676
- Water Gamayun
77+
- GhostRedirector IIS Module and Rungan Backdoor
7778
asset_type: Endpoint
7879
mitre_attack_id:
7980
- T1105

‎detections/endpoint/malicious_powershell_process___encoded_command.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Malicious PowerShell Process - Encoded Command
22
id: c4db14d9-7909-48b4-a054-aa14d89dbb19
3-
version: 16
4-
date: '2025-07-29'
3+
version: 17
4+
date: '2025-09-16'
55
author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community
66
status: production
77
type: Hunting
@@ -62,6 +62,7 @@ tags:
6262
- Crypto Stealer
6363
- Microsoft SharePoint Vulnerabilities
6464
- Scattered Spider
65+
- GhostRedirector IIS Module and Rungan Backdoor
6566
asset_type: Endpoint
6667
mitre_attack_id:
6768
- T1027

0 commit comments

Comments
 (0)