Georgios Maragos
@GmarakGreeceCompletionist
2 followers501 downloads300 copies8 likes5,907 views
46 detections
Filters
Last updated
All Time
Detection languages
45
1
Categories
21
14
8
6
4
Platforms
25
10
4
4
4
Products / Services
12
8
5
4
4
MITRE Techniques
18
8
8
8
7
CVEs
3
2
1
1
1
Detects a high volume of subscription or account confirmation emails directed at a single recipient within a one-hour window. This behavior, often referred to as 'email bombing,' can be used to disrupt user productivity, overwhelm inbox capacity, or serve as a distraction technique to hide other malicious activities, such as spearphishing or account takeover notifications.
Detects the creation of files named 'strEncodedData.txt' on the local file system. This naming convention is associated with the DarkTortilla RAT, which uses this specific file to stage encoded data prior to exfiltration or further processing.
Detects a significant surge of bulk or spam mail quarantine events for a single mailbox within a 15-minute window. This behavior often indicates a mail-bombing attack intended to overwhelm the user or as a distraction technique (smokescreen) to hide concurrent malicious activities such as exfiltration, lateral movement, or ransomware staging in the M365 tenant.
Detects Windows Application Error events where the faulting module is 'nvoglv64.dll'. This is indicative of a crash in the NVIDIA OpenGL/Vulkan user-mode driver, which may be associated with the exploitation of the GreenSection shared-memory corruption vulnerability.
Detects instances where a high-value security or transaction-related notification email is received concurrently with a burst of non-essential bulk or subscription-based emails. This pattern is indicative of an email-bombing (inbox flooding) attack, often used to bury critical alerts and mask malicious activity such as unauthorized account access or fraudulent financial transactions.
Detects instances where a Java process spawns a shell (cmd.exe, powershell.exe, sh, or bash) that executes suspicious commands often associated with remote code execution (RCE) patterns like those seen in Log4j exploitation. The rule excludes common Java-based build tools to reduce noise.
Detects suspicious child process creation (e.g., cmd.exe, powershell.exe) originating from Java applications where the command line contains indicators of deserialization vulnerabilities (e.g., FilteredObjectInputStream, Log4jLogEvent). This pattern is often associated with exploitation of Java applications to gain remote code execution.
Detects a Ray raylet, gcs_server, or dashboard process spawning a calculator process (a near-certain PoC/exploit indicator) or a shell child process carrying suspicious network, encoding, or reverse-shell command-line indicators, consistent with post-exploitation of CVE-2025-62593. Known-legitimate pipeline package-install commands are filtered out to reduce noise from normal Ray job workers.
Detects modifications to the 'userPrincipalName' attribute in Active Directory via Security Event ID 5136 where the assigned value lacks an '@' character. This behavior is indicative of the ResetNightmare exploitation technique (CVE-2026-27912), which involves setting the UPN to a bare sAMAccountName to facilitate unauthorized password resets or account takeover.
Detects a Value Added modification to the servicePrincipalName attribute where the new SPN value
contains non-printable/invisible Unicode characters (e.g. zero-width spaces/joiners, soft hyphen,
BOM, Mongolian vowel separator, or other invisible code points). This technique, described by
Semperis in their 'Identity Crisis' research as KerberLoss (CVE-2026-25177), can be used to bypass
SPN uniqueness verification by embedding hidden characters, enabling denial-of-service against
HOST-mapped services, SPN-jacking for constrained delegation abuse, or Kerberos-to-NTLM downgrade.
contains non-printable/invisible Unicode characters (e.g. zero-width spaces/joiners, soft hyphen,
BOM, Mongolian vowel separator, or other invisible code points). This technique, described by
Semperis in their 'Identity Crisis' research as KerberLoss (CVE-2026-25177), can be used to bypass
SPN uniqueness verification by embedding hidden characters, enabling denial-of-service against
HOST-mapped services, SPN-jacking for constrained delegation abuse, or Kerberos-to-NTLM downgrade.
Page 2 of 5