ills3c Intel&Coffee
@Ills3CUS MidwestCompletionist
0 followers425 downloads1,089 copies12 likes3,494 views
344 detections
Filters
Last updated
All Time
Detection languages
283
58
2
1
Categories
142
119
59
49
42
Platforms
215
125
39
25
23
Products / Services
152
29
27
23
22
MITRE Techniques
114
76
67
62
54
CVEs
3
3
3
2
2
IDS Classtypes
2
IDS Protocols
2
Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.
Detects when common office applications (Word, Excel, PowerPoint, Outlook, OneNote, etc.) or archive utilities/PDF readers spawn command-line interpreters or scripting engines (cmd.exe, powershell.exe, wscript.exe, etc.), which is a common indicator of phishing document execution or malicious archive extraction.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects Windows Terminal or related console hosts spawning PowerShell or PowerShell Core with command-line arguments indicative of staging, downloading, or executing remote scripts (such as encoded commands, Invoke-Expression, or web requests), commonly associated with ClickFix or social engineering techniques.
Detects virtualization management monitor (VMM) processes such as QEMU or Firecracker directly spawning an interactive shell, script interpreter, or network utility as the root user. This behavior is highly anomalous and may indicate a guest-to-host escape leading to remote code execution on the host.
Detects Linux hosts running vulnerable kernel versions older than the fixed builds for CVE-2026-99999 (PwnEscape) across enterprise Linux branches (el8, el9, el10).
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects the presence of vulnerable Wireshark software versions susceptible to CVE-2025-13945 and detects mitmproxy instances running without HTTP/3 disabled via the --set http3=false command line argument.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Page 28 of 35