Aaron Beardslee
@abeardsleeTrusted contributorCompletionist
2 followers335 downloads147 copies29 likes3,724 views
28 detections
Filters
Last updated
All Time
Detection languages
25
3
Categories
10
7
6
6
4
Platforms
23
3
2
Products / Services
4
4
3
2
2
MITRE Techniques
17
10
9
6
6
CVEs
4
1
Detects a PowerShell process reading the content of a batch script named 'rEgX.cmd' to extract an appended payload. This technique is used by the DeadVax malware as part of its stage 3 execution.
Detects the download and staging of an official Python embedded runtime zip file from python.org into suspicious user-writable directories like %TEMP% or %LOCALAPPDATA%, followed by its extraction. This is a key staging technique used by malware like VOID#GEIST to ensure its scripts can execute regardless of the victim's environment.
Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.
Detects the use of curl.exe where the User-Agent header is abused to pass a URL. This is a specific technique observed in the Notepad++ supply chain attack where attackers used it to exfiltrate reconnaissance data by sending a temp.sh URL to their C2 server.
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
Detects the legitimate Notepad++ updater (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was abused to download and execute malicious installers and command interpreters.
Detects the spawning of a Windows command shell, powershell, or reconnaissance tools by the IIS worker process (w3wp.exe). This behavior is a strong indicator of a successful web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an attacker gains remote code execution. Also detects the WSUS Service as the parent process spawning another process.
Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
Detects Kerberos service ticket requests (TGS) for canary Service Principal Names (SPNs). Any request for a ticket to a canary SPN is highly indicative of a Kerberoasting attack (T1558.003) or other reconnaissance activity, as these accounts have no legitimate purpose. Creation of Canary SPNs can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#creating-a-canary-spn-account
Page 1 of 3