Brandon Rodriguez
@BMRodriguezTrusted contributor
3 followers22 downloads772 copies15 likes20,508 views
123 detections
Filters
Last updated
All Time
Detection languages
123
Categories
43
30
18
15
13
Platforms
84
23
10
7
7
Products / Services
39
9
7
7
4
MITRE Techniques
36
36
28
27
21
Detects the execution of PowerShell with a command line containing a specific sequence of strings associated with extracting and executing malware from a ZIP file, as observed in the Steam_Monitor campaign. This typically involves using PowerShell commands like 'Get-ChildItem', '::OpenRead', and 'TaR' in conjunction with a '.zip' file.
Detects the use of netsh.exe to create a firewall rule that blocks all outbound traffic. This technique is often used by attackers to isolate a compromised host from external resources (like security tool cloud consoles) while maintaining internal network access for lateral movement.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Page 13 of 13