hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_suspicious_executable_memory_mapping.tomlURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 15 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Taking SHELLTER: a commercial evasion framework abused in-the-wild“- [Suspicious Executable Memory Mapping](hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_suspicious_executable_memory_mapping.toml)”
Indicators reported together
named in the same reports- c865f24e4b9b0855…9a36fbbc2d30in 1 report
- 7d0c9855167e7c19…d25a99b03a10in 1 report
- b3e93bfef1267829…66f122a14dadin 1 report
- da59d67ced88beae…559d00d2c880in 1 report
- 70ec2e65f77a940f…992c1bf974f1in 1 report
- hxxps://www.reddit[.]com/r/PartneredYoutube/comments/1ks2svg/skillshare_sponsorship/in 1 report
- 185.156.72[.]80in 1 report
- hxxps://github[.]com/elastic/labs-releases/tree/main/tools/shellterin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_from_unusual_microsoft_signed_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_unbacked_shellcode_from_unsigned_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_execution_from_low_reputation_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_potential_evasion_via_invalid_code_signature.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_thread_suspension_from_unbacked_memory.tomlin 1 report
- 263ab8c9ec821ae5…fad98d862892in 1 report
- eaglekl[.]digitalin 1 report
- 94.141.12[.]182in 1 report
- plotoraus[.]shopin 1 report
- hxxps://www.shellterproject[.]com/shellter-editions-feature-comparison-table/in 1 report
- www.shellterproject[.]comin 1 report
- hxxps://www.shellterproject[.]com/Downloads/ShellterElite/Shellter_Elite_Exclusive_Features.pdfin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.