Georgios Maragos
@GmarakGreeceCompletionist
2 followers501 downloads300 copies8 likes5,907 views
46 detections
Filters
Last updated
All Time
Detection languages
45
1
Categories
21
14
8
6
4
Platforms
25
10
4
4
4
Products / Services
12
8
5
4
4
MITRE Techniques
18
8
8
8
7
CVEs
3
2
1
1
1
Detects an SSL_HANDSHAKE_FAILURE syslog event on a Citrix NetScaler appliance characterized by a DTLSv1.0 client version and a 'Handshake failure-Internal Error' reason. This pattern is indicative of exploitation attempts against CVE-2026-88772, specifically associated with the WHIPSHOT/SLAPSHOT campaign. This is a high-sensitivity precursor signal that should be correlated with system crash events on the appliance for increased confidence.
Detects evidence of the SLAPSHOT backdoor on Citrix NetScaler appliances by identifying specific ephemeral IPC files (/tmp/.uxdport and /tmp/.uxdlock) or the associated python-based launcher process that uses base64-encoded arguments to initialize the proxy daemon.
Detects attempts to modify the Redis configuration (dir or dbfilename) followed by a SAVE command, which can be leveraged to write arbitrary data to critical system files such as crontabs for persistence.
Detects Microsoft Defender (MsMpEng) performing scan or remediation actions against non-standard filesystem paths, specifically NT object-manager namespace paths or CLFS-driver-prefixed paths. This behavior is indicative of an exploitation attempt (e.g., CVE-2026-69414) where an attacker uses symbolic links and CLFS driver namespaces to redirect the Defender scanning engine to arbitrary files on the system, potentially allowing file reads as SYSTEM.
Detects the execution of known remote monitoring and management (RMM) software often abused by threat actors following social engineering attempts, such as helpdesk impersonation, to establish persistence and remote access prior to deploying ransomware.
No description available.
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
Detects signs of email bombing by monitoring for critical thresholds in mail server queue size, transfer latency, or a significant spike in SMTP connection attempts targeting individual mailboxes. This activity often aims to disrupt email service availability, bury critical alerts, or facilitate social engineering attacks.
Detects Microsoft Teams chat and message events originating from unverified or external tenants that attempt to impersonate internal IT helpdesk personas. This activity is often part of a multi-stage social engineering campaign, potentially following email bombing, where attackers aim to trick users into executing malicious files or installing remote access tools.
Detects the installation or execution of common remote monitoring and management (RMM) tools, including AnyDesk, TeamViewer, ScreenConnect, and Quick Assist. These tools are frequently abused by adversaries for persistence and command-and-control post-compromise.
Page 1 of 5