ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,085 copies12 likes3,488 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects Microsoft Teams chat creation events originating from an external sender whose user ID or display name impersonates IT support (e.g., IT Support, Help Desk, Service Desk), often used in social engineering or phishing attempts.
Correlates PHP memory exhaustion or heap corruption error messages with subsequent Apache worker crashes (segfaults, aborts, bus errors) on the same host within a 5-minute window to detect potential exploitation attempts.
Detects Node.js builds, Express, and body-parser libraries vulnerable to CVE-2026-111497 (Node2Shell) via Microsoft Defender vulnerability inventory, process telemetry, and software inventory.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects exploitation attempts against CVE-2024-4577, a PHP-CGI argument injection vulnerability, by identifying soft-hyphen encoding (%AD) injected alongside PHP configuration options such as allow_url_include and auto_prepend_file=php://input in request URLs.
Detects instances where Microsoft Teams (ms-teams.exe, Teams.exe) or its associated WebView2 process spawns a command or script interpreter (such as PowerShell, Cmd, Mshta, Wscript, Cscript) with suspicious download-and-execute arguments, which is commonly associated with ClickFix social engineering attacks or similar initial access tactics.
Detects the Inisafe CrossWeb EX service (INISAFECrossWebEXSvc.exe) launching fsquirt.exe, which can indicate potential abuse of built-in Windows utilities following a malicious lure or script execution.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Page 2 of 35