Suraj A
@cytechCompletionist
0 followers115 downloads378 copies2 likes1,160 views
90 detections
Filters
Last updated
All Time
Detection languages
72
18
Categories
52
42
15
11
11
Platforms
70
50
18
3
3
Products / Services
42
17
10
8
7
MITRE Techniques
32
20
19
19
18
CVEs
12
10
9
1
1
Detects outbound network connections from the AOMEI updater process (ABNotify.exe) to public IPs over SMB or WebDAV ports (445, 80, 8080, 443), or connections to a known actor IP.
Detects a potential command and control (C2) dead-drop sequence where a non-browser process fetches raw content from Pastebin and subsequently contacts a specific C2 domain within the same process context.
Detects network activity involving a specific suspicious webhook domain or URL path alongside connections to legitimate external services (such as Telegram or GitHub API) from non-standard processes on the same device, which may indicate command and control (C2) or data exfiltration behavior.
Detects indicators related to CROSSROAD/SHINYROAD/ADAPTAGENT activity, including specific PE version metadata typos ('AOMEI Update Compent'), known file hashes, and Radmin launchers running with the '--runtimechk' argument from the AppData directory.
Detects a PHP FastCGI or web worker process spawning a command line that combines temp-directory probing, file writing, execution, and deletion steps characteristic of a web shell or automated webshell deployment behavior.
Detects when a PHP or web server worker process (such as php-fpm, apache2, httpd) spawns a shell or script interpreter (such as sh, bash, python, cmd.exe), which may indicate a web shell execution, post-exploitation activity, or a successful cross-request use-after-free leading to command execution.
Detects a high volume of HTTP POST requests targeting .php endpoints directly on an IIS server without routing through a CDN or WAF, identified by missing X-Forwarded-For headers or empty user agents.
Detects a sequence of PHP memory allocation failures followed by worker crashes (segmentation faults/signal 11) on the same host within a 15-minute window, potentially indicating OPcache shared-memory corruption or application instability.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects modifications to the Windows Winlogon Shell registry key where the value contains explorer.exe followed by an additional executable path (such as conhost.exe), which is a common persistence mechanism used by adversaries.
Page 8 of 9