Suraj A
@cytechCompletionist
0 followers115 downloads377 copies2 likes1,159 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects the tailscaled daemon spawning a shell or interpreter (such as sh, bash, python, nc, etc.) running as the root user, which may indicate Tailscale SSH socket forwarding or related root privilege escalation techniques (Tailworm F1/F2).
Detects execution of conhost.exe from non-standard directories outside System32, SysWOW64, or WinSxS. Specifically targets drops within the user profile under AppData\Local\Microsoft\Conhost\ or when initiated by node.exe, which can indicate npm preinstall hooks or malware attempting to masquerade or abuse console host execution.
Detects reverse shell constructs (such as /dev/tcp/, fsockopen, or mkfifo) executed in command lines of child processes spawned by web servers or PHP workers, indicating potential post-exploitation activity such as web shell usage.
Detects a sequence where a PHP or web worker process crashes, followed by the same worker lineage spawning a shell on the same device within a 15-minute timeframe, which can be indicative of stale-pointer corruption leading to remote code execution.
Detects a suspicious sequence of HTTP requests to an upload endpoint (/upload.php) characterized by alternating GET and POST requests across multiple session cookies, culminating in a large POST body within a short time window. This behavior often indicates web shell staging, file upload exploitation, or automated scanning and exploitation tools targeting web applications.
Detects indicators associated with the KNTRAT implant, including the creation of named pipes containing the 'kntrat' prefix and the execution of cmd.exe spawned by a conhost.exe instance running outside of legitimate Windows system directories.
Detects execution or modification of conhost.exe from within a non-standard user-profile path (Microsoft\Conhost), which may indicate an attempt to masquerade or use renamed/relocated utilities.
Detects common reconnaissance commands (whoami, id, uname, ipconfig) executed directly by web server workers or via shells spawned by web workers, indicative of web shell usage or exploitation.
Detects correlation between PHP memory exhaustion fatal errors (OutOfMemory) and Apache worker segmentation faults occurring on the same host within a 15-minute window, which can indicate exploitation attempts or abnormal resource exhaustion.
Detects outbound network connections to known campaign staging domains or rented infrastructure IPs associated with specific threat activity.
Page 7 of 9