ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,495 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.
Detects web server processes (such as apache2, nginx, httpd, php-fpm, or w3wp.exe) spawning shell interpreters (such as bash, sh, cmd.exe, or powershell.exe), which is a common indicator of web shell activity or application exploitation.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects potential cryptocurrency clipper malware by monitoring the staging of multiple attacker wallet addresses (BTC, ETH, TRC) under the HKCU\Software\Clipper registry path by a non-system process.
Detects the creation of a scheduled task named ChromeUpdate with highest privileges on logon, initiated from a process running within the user AppData\Local\Temp directory.
Detects when a process modifies the Windows Registry to disable zone checks (SEE_MASK_NOZONECHECKS) in the Environment key and alters settings to show hidden files (ShowSuerHidden) within 30 minutes on the same device. This behavior is commonly associated with malware attempting to execute downloaded payloads without security prompts while concealing artifacts.
Page 17 of 35