Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,071 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects a DLL file being created directly under C:\Windows\System32 by a process running at less than System integrity (not SYSTEM/TrustedInstaller). Legitimate System32 DLL writes are performed by installers or the OS itself running with SYSTEM privileges; a standard-user or low/medium-integrity process writing a new DLL into this protected path is consistent with the HardBreacher/SolidSnake local privilege-escalation exploit chain. Scoped on protected-directory + non-privileged-writer, not on filename, to generalize to renamed variants.
Detects a command shell (cmd.exe, powershell.exe, powershell_ise.exe, pwsh.exe) created with a SYSTEM SID whose immediate parent process is a POSITIVELY IDENTIFIED non-SYSTEM account running at Low/Medium integrity. Excludes known-benign SYSTEM-spawning binaries and blank-parent scheduled-task/service noise confirmed via live telemetry and attached evidence logs, and drops the prior TokenElevationTypeFull branch which mostly matched routine UAC-elevated admin activity rather than an actual SYSTEM token.
Detects offreg.dll (Windows Offline Registry Library) being loaded by a process running outside the standard System32/SysWOW64 directories and that is not a known Windows registry-management host process, excluding Malwarebytes' own bundled private copy of the DLL. PrettyPrague uses this library to read the SAM/LSA hive and derive boot-key material outside normal registry API paths. Scoped to the loading process's directory and identity rather than any specific PoC binary name.
Detects access to the SAM registry hive or SAM-related LSA control keys initiated by a process associated with the Avast Sandbox component rather than LSASS or an administrative security tool. The PrettyPrague PoC abuses a vulnerability in Avast Sandbox to dump the SAM database and spawn a SYSTEM shell, so SAM hive reads originating from the sandbox component itself are anomalous.
Detects a DLL created or modified directly under C:\Windows\System32 that is then loaded into a process within 30 minutes of its creation. This creation-to-load temporal correlation is a durable indicator of a dropped-and-loaded malicious module (as used by the HardBreacher/SolidSnake exploit chain), independent of the DLL's filename. Signer/trust correlation intentionally omitted (DeviceFileCertificateInfo not part of this environment's ingested telemetry).
Detects execution of PowerShell commands that use obfuscated [char[]] hex arrays in conjunction with 'iex' (Invoke-Expression) to run code in memory. This pattern is commonly used by loaders like SynkLoader (cleaner.ps1) to execute scripts while avoiding disk artifacts.
Detects the SynkLoader RAT by identifying the pythonw.exe process loading a spoofed msvcp150.dll from a specific staging path (\fl\ang\), combined with correlative beaconing activity via repeated network connections to remote endpoints.
Detects a PowerShell in-memory loader pattern that derives an AES key using Rfc2898DeriveBytes, decrypts an encrypted payload using System.Security.Cryptography.Aes, verifies the content with SHA256, and executes the decrypted code in-memory via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass file-based security controls by executing stage-two payloads directly in memory.
Detects Python or PythonW processes loading an illegitimate 'msvcp150.dll' (masquerading as a Visual C++ redistributable) that simultaneously loads the .NET 'System.Management.Automation' assembly. This behavior is indicative of the SynkLoader technique, where a malicious native DLL is used as a bridge to execute PowerShell commands within the memory space of a Python process, bypassing traditional script-based detection.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Page 1 of 119