Georgios Maragos
@GmarakGreeceCompletionist
2 followers501 downloads300 copies8 likes5,907 views
46 detections
Filters
Last updated
All Time
Detection languages
45
1
Categories
21
14
8
6
4
Platforms
25
10
4
4
4
Products / Services
12
8
5
4
4
MITRE Techniques
18
8
8
8
7
CVEs
3
2
1
1
1
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
Detects repeated Nginx worker process crashes terminated by signals 6 (SIGABRT) or 11 (SIGSEGV) accompanied by core dumps. High-frequency crashes originating from a single source are indicative of an adversary brute-forcing ASLR in preparation for exploitation of memory corruption vulnerabilities (e.g., buffer overflows or heap clobbering) to achieve remote code execution.
Detects instances where an nginx worker process spawns a shell interpreter, such as sh or bash. This behavior is highly irregular for a web server and is often indicative of exploitation of a remote code execution vulnerability, such as the referenced CVE-2026-42533.
Detects potential SQL injection attempts targeting the WordPress REST API batch endpoint (/wp-json/batch/v1) specifically attempting to query the wp_users table for credential fields such as user_pass or user_login.
Detects a specific attack chain where users are tricked into copying and pasting a malicious command (ClickFix) that downloads and executes a secondary stager named winPatch.zip via curl or wscript.exe, commonly associated with recent social engineering campaigns.
Detects lateral movement patterns involving PsExec or PSEXESVC where either a suspicious command-line flag (e.g., '-psex') is present or the PsExec service spawns child processes like cmd.exe or powershell.exe executing suspicious, obfuscated, or remotely retrieved payloads.
Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.
Detects suspicious use of the OAuth 2.0 device code authentication flow. The rule identifies potential token harvesting and phishing attempts by flagging device code sign-ins that originate from unusual user agents, unknown IP addresses or ASNs, unrecognized applications, or for users who have not previously utilized device code authentication. Legitimate, first-party applications like Azure CLI and Azure PowerShell are explicitly excluded to minimize noise.
Detects potential execution of malicious HTA files or encoded PowerShell commands initiated from the Windows Explorer Run dialog. This behavior is consistent with 'ClickFix' social engineering attacks where users are tricked into copying and pasting commands into the Run dialog to bypass security controls under the guise of verifying a fake CAPTCHA.
Page 3 of 5