ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,494 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Identifies deployments of Gotenberg vulnerable to CVE-2026-42589 across multiple Microsoft Defender telemetry sources including TVM inventory, vulnerabilities, container images, listening services, and binaries on disk.
Detects execution and network activity associated with the cache_base operator toolkit, including JuicyPotatoNG (kitanai.exe), RegPwn (nandemo.exe), ufw.exe reverse shell, and upd-ms.bat launching these tools with connections to *.strangled.net on port 7070.
Detects when a shell process (such as sh, bash, dash, cmd.exe, or powershell.exe) is spawned by a metrics, logging, or authentication management service shortly after the service accepts an inbound network connection, potentially approximating exploitation of an internal management service.
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Detects script execution (such as wscript, cscript, mshta) spawned from a shell parent process (like explorer.exe or cmd.exe) referencing browser cache files (matching f_* in browser profile directories) or copying scripts to the local Temp directory as t.vbs.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Detects the presence of the OrbitalVoyage payload package or related artifact names in device file and process telemetry, including suspicious APK installations outside of authorized paths.
Detects a successful device code flow sign-in followed within one hour by a successful sign-in from the same user using a different IP address and country. This pattern can indicate device code phishing or abuse of the OAuth 2.0 device authorization grant flow.
Page 15 of 35