MikeGPT CyberSecurity

# CrowdStrike Falcon Platform Configuration Steps # Goal: Enhance prevention policies against threats like Maranhão Stealer. # --- IMMEDIATE ACTIONS --- # 1. Enable Aggressive Prevention Policies: # - Navigate to: Endpoint Security -> Configuration -> Prevention Policies. # - Select your primary policy and click 'Edit'. # - Under 'Next-Gen Antivirus', set both 'Cloud-Based Machine Learning' and 'On-Sensor Machine Learning' for both Detection and Prevention to 'Aggressive'. # - This increases sensitivity to novel malware behavior. # 2. Block Suspicious Scripts: # - In the same Prevention Policy, go to 'Sensor Visibility' -> 'Script-Based Execution Monitoring'. # - Ensure 'PowerShell', 'VBScript', and 'JScript' monitoring are enabled for enhanced visibility into script-based attacks. # 3. Enable Identity Protection: # - Navigate to: Identity Protection -> Configuration -> Policies. # - Ensure policies are active to detect and prevent credential theft and lateral movement, common objectives for info-stealers. # --- VERIFICATION STEPS --- # 1. Review Detection Events: # - Navigate to: Endpoint Security -> Investigate -> All Detections. # - Filter for detections related to 'Machine Learning' or 'Scripting' in the last 24 hours to verify policies are triggering correctly. # 2. Run a Test Detection: # - Use a non-malicious test file (like an EICAR file executed via a PowerShell script) on a test machine to confirm that detection and prevention are functioning as expected under the new aggressive policy.

rule Maranhao_Stealer_NodeJS_Artifacts_v2 { meta: description = "Detects Node.js-based Maranhão Stealer artifacts (reflective loader, node runtime refs, stealer strings). Tuned to reduce false positives." author = "Threat Rundown" date = "2025-09-15" reference = "https://cyble.com/?p=99978" strings: $s_reflect = "ReflectiveLoader" ascii wide $s_nodeexe = "node.exe" ascii wide $s_nodemod = "/node_modules/" ascii wide $s_getpwd = /get(pass(word)?|pwd)/ ascii wide nocase $s_getcok = "getCookies" ascii wide nocase $s_require = "require(" ascii nocase $s_appjs = ".js" ascii condition: // Must be a PE and not obviously huge installer uint16(0) == 0x5a4d and filesize < 10MB and // Strong match combinations: ( // Node runtime + modules path (likely packaged Node app) ($s_nodeexe and $s_nodemod) or // Reflective loader plus stealer functions ($s_reflect and ( $s_getpwd or $s_getcok )) or // Generic heuristic: at least 3 indicators if no ReflectiveLoader present ( (uint16(0) == 0x5a4d) and (#{$s_nodeexe, $s_nodemod, $s_getpwd, $s_getcok, $s_require, $s_appjs} >= 3) ) ) }

// Splunk/QRadar Style Query // Purpose: Identify potential drive-by-downloads from low-reputation domains, a TTP in the HiddenGh0st campaign. sourcetype=proxy OR sourcetype=firewall | iocparser | search file_type IN ("exe", "dll", "msi", "zip") | lookup threat_intel_domain_feed domain as dest_host OUTPUT reputation, first_seen | where reputation='low' OR (first_seen > relative_time(now(), "-7d")) | stats count by src_ip, dest_host, file_name, user | where count = 1 | sort -_time

# Purpose: Hunt for potential file system artifacts related to a Node.js-based stealer on a local machine. $userProfiles = Get-ChildItem "C:\Users" -Directory $searchPaths = @("\AppData\Roaming\", "\AppData\Local\Temp\") $suspiciousKeywords = @("*node_modules*", "*electron*", "*.js.bak") Write-Host "[*] Starting hunt for suspicious Node.js artifacts..." foreach ($profile in $userProfiles) { foreach ($path in $searchPaths) { $fullPath = $profile.FullName + $path if (Test-Path $fullPath) { Get-ChildItem -Path $fullPath -Recurse -Include $suspiciousKeywords -ErrorAction SilentlyContinue | ForEach-Object { Write-Warning "[!] Potential suspicious artifact found: $($_.FullName)" } } } } Write-Host "[*] Hunt complete."