Aitor Fernández
@DarkW0lfCompletionist
0 followers0 downloads72 copies0 likes5,803 views
6 detections
Filters
Last updated
All Time
Detection languages
6
Categories
2
2
2
2
2
Platforms
4
4
3
1
Products / Services
3
2
2
1
1
MITRE Techniques
3
2
2
2
2
CVEs
3
Detects suspicious command execution originating from cPanel daemons. This rule identifies instances where cPanel processes (cpsrvd, cpsrvd-ssl, cpaneld, whostmgrd) or their immediate children execute common shell interpreters or specific commands indicative of potential compromise, such as writing to /etc/passwd, modifying authorized_keys, or using base64/perl/python/bash for interactive shells.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
Detects DNS lookups and outbound network connections to known PhantomRaven command and control (C2) infrastructure, including specific domains and IP addresses. The rule also specifically identifies potential data exfiltration attempts to the '/mozbra.php' endpoint.
Detects network connections to known PhantomRaven Wave 5 command-and-control infrastructure. PhantomRaven is an NPM supply chain attack targeting DeFi, Cloud, and AI developers.