Omar A.

icon company @kasperskylab icon location Security Researcher @ Kaspersky Global Research and Analysis Team

Results 2 issues of Omar A.

Add Rule: proc_creation_win_renamed_ssh.yml

### Summary of the Pull Request This PR adds detection for the renaming of the SSH client on Windows, based on the following reference: [Rapid7 Blog on Black Basta Ransomware](https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators/)....

Rules
Author Input Required
Windows

Adding Predator new ioCs

Adding New IoCs provided by [Insikt Group](https://www.recordedfuture.com/research/predator-spyware-infrastructure-returns-following-exposure-sanctions) Based on new IoCs provided by Insikt Group, I have identified two additional fresh domains **gamestuts[.]com**, _created 28 days ago_, as it shares...