Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,144 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects web server worker processes (such as PHP-FPM, Apache httpd, etc.) launching shells, interpreters, or download/network tools, which is a common post-exploitation pattern following remote code execution (RCE) vulnerabilities.
Detects a Python process spawning a Node.js child process that executes a JavaScript script located within a temporary directory, accompanied by a .json or .br configuration argument, matching known PoC execution patterns (such as CVE-2026-111497).
Detects web server worker processes and PHP runtimes (associated with CVE-2026-109618 and CVE-2026-109619) spawning command-line shells, interpreters, or data transfer utilities, indicative of post-exploitation or RCE.
Detects potential manipulation of Anthropic Claude configurations via command-line setting of ANTHROPIC_BASE_URL to non-standard endpoints, or the creation/modification of Claude configuration files (CLAUDE.md, AGENTS.md, or settings.json) within user Downloads directories.
Detects shadow copy deletion, boot recovery disabling, and the stopping of critical services or processes commonly halted prior to data encryption by ransomware operators.
Detects web server or PHP worker processes spawning command interpreters, shells, or transfer tools, which is indicative of post-exploitation or remote code execution vulnerabilities.
Detects web server or PHP worker processes (such as php-fpm, httpd, or w3wp.exe) creating, modifying, or renaming .php files within common web root directories, which is a common indicator of web shell deployment or webshell activity.
Detects post-exploitation behavior where a Node.js, Node, or Bun runtime spawns a Unix shell process (such as sh, bash, or dash) with command line arguments indicative of code execution, reverse shells, or download tools (e.g., -c, /dev/tcp, mkfifo, curl, wget, nc, base64).
Detects potential system tampering via boot configuration modifications (bcdedit.exe with integrity/testsigning options), EFI System Partition (ESP) mounting (mountvol.exe /s), or unauthorized bootloader/bcdboot activity executed from non-standard parent processes.
Detects process creation of known C2 and tunneling tools associated with INC and The Gentlemen ransomware affiliates, including Sliver, RevSocks, Ghost C2, Athena, QuickLine, and Phantom, by matching image names, original file names, or command-line arguments.
Page 3 of 9