Suraj A
@cytechCompletionist
0 followers115 downloads374 copies2 likes1,149 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects potential session hijacking or token theft where a user signs in using the Microsoft Teams app ID from an Android context with an unrecognized user agent, followed by Microsoft Graph API access from a different IP address and device ID within one hour.
Detects PowerShell encoded commands, download cradles, and scheduled task creation launching PowerShell or script content, consistent with INC and The Gentlemen ransomware affiliate tooling staging.
Detects shadow copy deletion, boot recovery disabling, and the stopping of critical services or processes commonly halted prior to data encryption by ransomware operators.
Detects lateral movement behaviors associated with ransomware affiliates, including remote service creation using PsExec-style binaries or admin-share paths, command-line access to SMB admin shares, and enabling Remote Desktop Protocol via registry modifications or firewall rule updates.
Detects PHP or web server worker processes spawning network or transfer utilities such as curl, wget, nc, or certutil, which is indicative of post-exploitation activity like web shell command execution.
Detects quick reconnaissance commands (such as whoami, id, uname, ipconfig) executed directly by a web server worker (e.g., PHP-FPM, Apache httpd) or via a shell child process of the web server worker, indicative of post-exploitation activity like php2shell.
Detects network connection attempts to archivetj.com, which is used as an IOC by the BlackX Rust payload to fetch DLL plugins as detailed in the BlackX UEFI bootkit report.
Detects the execution of various AI coding assistant and CLI tools (such as Claude, Codex, Cursor, and Gemini) where the binary path or command line indicates execution from a Downloads folder, which is a common indicator of user-downloaded utilities running without proper installation.
Detects Windows process creation for Active Directory reconnaissance and Kerberoasting tooling (Rubeus, SharpHound, net group queries for domain admins, nltest) and noPac / Zerologon follow-on tooling associated with the INC and The Gentlemen ransomware intrusion chain.
Detects LSASS memory dumping and Active Directory credential extraction techniques using comsvcs.dll MiniDump, Procdump, and Ntdsutil, associated with ransomware affiliates.
Page 5 of 9