Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,074 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.
Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Detects Microsoft 365 service principals using application-only (client-credentials) authentication to access the Microsoft Graph API, specifically targeting the calendarView endpoint of user mailboxes. This behavior matches the HOLLOWGRAPH attack technique, which leverages M365 calendars as a covert command-and-control (C2) channel.
Detects a VBS script invoking PowerShell to decode a Base64 payload, write it to disk with a random name, and decompress it using IO.Compression.GzipStream into tmp*.bat.gz/tmp*.bat files, consistent with the AutoIT-based VIPKeylogger/MedusaHVNC infection chain.
Detects Office 365 calendar events created or modified with a specific far-future date (2050-05-13) or dates scheduled more than 10 years into the future. This behavior is associated with the HOLLOWGRAPH backdoor, which uses calendar items as a C2 channel to hide tasking or exfiltration events from the mailbox owner.
Detects the creation of a Windows service named 'svchost32' with a display name of 'Cloud Sync Service' via administrative command-line utilities like sc.exe, PowerShell, or cmd.exe. This activity is a known persistence mechanism for the CornFlake RAT, which masquerades as a legitimate system process to evade detection.
Detects the execution of the 'clientCode' RAT process when initiated by a Node.js process (node.exe/node). This behavior is indicative of a second-stage payload execution related to supply chain compromises where malicious dependencies are leveraged to gain remote shell access.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Page 10 of 119