Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,149 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects LSASS memory dumping and Active Directory credential extraction techniques using comsvcs.dll MiniDump, Procdump, and Ntdsutil, associated with ransomware affiliates.
Detects lateral movement behaviors associated with ransomware affiliates, including remote service creation using PsExec-style binaries or admin-share paths, command-line access to SMB admin shares, and enabling Remote Desktop Protocol via registry modifications or firewall rule updates.
Detects process execution of Node.js or Bun where inline scripts or command-line arguments utilize Brotli decompress functions from the zlib library.
Detects hosts running vulnerable or end-of-life (EOL) versions of PHP based on software inventory data, exposing them to potential remote code execution and application-level exploits.
Detects network connections and requests to specialsseason.com, an IOC associated with the Huntress php2shell advisory.
Detects files whose Authenticode signatures chain to compromised eMudhra OV Code Signing intermediate certificates (G3B/G3C) whose private keys were recovered.
Detects the execution of reverse shell commands, interpreters, or utilities (such as Netcat, Python, or bash using /dev/tcp) spawned from web server worker processes or script interpreters, which is typically indicative of a web shell or remote code execution exploitation.
Detects the creation or renaming of AI assistant and LLM configuration files (such as AGENTS.md, CLAUDE.md, GEMINI.md, or .cursorrules) within the Downloads directory originating from common web browsers.
Detects PowerShell encoded commands, download cradles, and scheduled task creation launching PowerShell or script content, consistent with INC and The Gentlemen ransomware affiliate tooling staging.
Detects Linux process activity consistent with post-exploitation of a self-managed GitLab instance (CVE-2026-97229). This includes editing of gitlab.rb configuration files, registration of CI runners or creation of tokens via gitlab-rails/gitlab-rake, and outbound curl/wget connections launched by GitLab service accounts.
Page 4 of 9