Reyben Cortes
@ReybendeteccTrusted contributorCompletionist
3 followers37 downloads40 copies22 likes1,258 views
8 detections
Filters
Last updated
All Time
Detection languages
8
Categories
3
2
2
2
2
Platforms
4
2
Products / Services
4
2
2
MITRE Techniques
4
4
3
3
2
Detects indicators associated with a watering hole attack originating from a compromised xubuntu.org website. This includes the creation of a tampered 'tos.txt' file, the dropping and execution of a trojanized dropper ('elzvcf.exe') in AppData\Roaming, and the establishment of persistence via a registry Run key.
Detects potential exploitation attempts against FortiWeb CVE-2025-52970. The detection looks for individual HTTP GET requests to a specific API endpoint with a crafted APSCOOKIE_FWEB cookie containing 'Era=9'. The rule enriches alerts with information about known malicious IPs without strictly filtering on them.
Identifies devices with vulnerable versions of popular password manager browser extensions installed and active. These versions are susceptible to credential theft via DOM manipulation by malicious web pages. Note:
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
This is potential for false positives; the exploit is Client-side, out of reach for traditional detection. The detection will only validate vulnerable versions for the following password manager vendors who have not remediated all the vulnerabilities in the report by researcher Marek Tóth.
Detects hard IoCs and activity associated with a trojanized installer of Velociraptor incident response tool making callbacks to C2 domains from workers[.]dev and tunneling with Visual Studio Code (code.exe). The detection looks for the creation of hard IoCs from this malicious Velociraptor installer V2.msi, followed by network connections to known C2 domains and the execution of related processes, including PowerShell (with support for detecting encoded commands to install code.exe) and msiexec activity tied to malicious domains.
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
Detects SQL injection attempts targeting FortiWeb (CVE-2025-25257) in HTTP GET requests to /api/fabric/device/status. The rule identifies known exploit payloads in the Authorization header, generic SQL injection patterns, and SQL statements like DROP, DELETE, INSERT, UPDATE, CREATE. It also detects known malicious source IPs targeting the vulnerable endpoint.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
This rule detects potential exploitation attempts against three pre-authentication vulnerabilities in SonicWall SMA100 series devices: CVE-2025-40596 (stack-based buffer overflow via long URI path), CVE-2025-40597 (heap-based buffer overflow via long Host header), and CVE-2025-40598 (reflected Cross-Site Scripting in /cgi-bin/radiusChallengeLogin).