ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,495 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects web server processes (such as Apache, httpd, or PHP) spawning a Unix shell (sh, bash, dash) and executing discovery commands (such as id, hostname, uname) with output redirection to proof files or embedded in callback URLs via command substitution.
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Detects potential vulnerability scanning, enumeration, or bulk data extraction against Request Tracker (RT) web paths by monitoring high request volumes, distinct URI counts, or large response byte sizes within CommonSecurityLog data.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
Detects Chromium-based browsers launched with remote debugging port 9222 or execution of chrome-decryptor tooling by Python processes, indicative of credential theft or Chrome CDP cookie extraction (such as Armorsteal).
Detects suspicious process execution where a shell or scripting tool is spawned by the nsppe process or running under the nobody account, followed closely by file creation or modification activity in persistence locations or NetScaler GUI web directories.
Detects potential tampering of Apache HTTP Server configuration files (httpd.conf) involving PHP engine or script handlers, followed closely by an Apache service reload (HUP signal) on the same device within a 10-minute window.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Detects web or FTP server parent processes (such as apache2, httpd, nginx, php-fpm, or proftpd) spawning shell or utility processes (such as bash, sh, python, nc, curl, wget), which is consistent with webshell execution or post-exploitation activities.
Page 18 of 35