Aaron Beardslee
@abeardsleeTrusted contributorCompletionist
2 followers335 downloads147 copies29 likes3,724 views
28 detections
Filters
Last updated
All Time
Detection languages
25
3
Categories
10
7
6
6
4
Platforms
23
3
2
Products / Services
4
4
3
2
2
MITRE Techniques
17
10
9
6
6
CVEs
4
1
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Detects DLL side-loading attacks where consent.exe loads known malicious
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
Detects access to hidden or decoy network shares that are not used by legitimate processes. This activity is indicative of network reconnaissance and lateral movement attempts. Walkthrough of Canary Shares can be found here: https://github.com/fluffybunnies-h4x/CyberDeception/blob/main/README.md#canary-shares
Detects Windows VBScript processes (wscript.exe or cscript.exe) performing DNS queries for AI/LLM API domains. This behavior is a key indicator of malware like PROMPTFLUX and WormGPT, which leverage these APIs for dynamic code generation and evasion. This activity is highly suspicious as VBScript engines rarely perform external network operations to these types of services. Sysmon event id 22 is the best way to detect this behavior on endpoints.
Detects HTTP POST requests containing a JSON-RPC payload with the 'eth_call' method. This is often used by web-based crypto wallets or dApps to interact with the Ethereum blockchain, but can also be used by malicious JavaScript for activities like cryptojacking or wallet draining.
Detects unauthorized access to decoy files (canary files) placed in strategic locations. By monitoring for access to files with enticing names (e.g., 'passwords.xlsx'), organizations can identify file discovery and data staging activities. Any access to these files is highly suspicious as they have no legitimate purpose. Walkthrough for the creation of Canary Files can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#canary-files
Detects the GNU telnetd service spawning the login binary with the '-f' flag, which is used to skip authentication. This is the primary indicator of the CVE-2026-24061 exploitation. This detection requires process creation logging on Linux, which can be enabled via tools like Sysmon for Linux.
Detects authentication attempts (successful or failed) against designated canary user accounts. Any such attempt is highly suspicious as these accounts have no legitimate purpose and indicate credential theft or discovery activity. Creation of Canary Accounts with scripts and other strategies can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#canary-accounts
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the execution of 'polers.dll' via rundll32.exe, a command-line pattern used by the Interlock ransomware group's 'Hotta Killer' tool to terminate security software by exploiting CVE-2025-61155.
Page 2 of 3