Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the deletion of the RunMRU registry key and the clearing of the clipboard within a short time window on the same host. This sequence of anti-forensic actions is used by the batch script component of the Dohdoor malware campaign to hide its tracks.
Detects the execution of AutoIt3.exe (or renamed versions) from non-standard paths or with suspicious script extensions, which is indicative of CastleLoader activity. This rule specifically looks for AutoIt interpreter execution, including renamed files with .pif or .com extensions, originating from common temporary or user-writable directories like AppData or Temp, and executing suspicious script file extensions such as .a3x, .t, or .vstm, or very short command lines.
Detects the addition of a specific threat actor SSH key to an authorized_keys file for persistence. This key was used in a campaign involving a malicious Go crypto module that delivered the Rekoobe backdoor. The rule specifically looks for command-line activity that modifies the authorized_keys file and contains the hardcoded malicious SSH key, often initiated by shell processes.
Detects a Node.js process making outbound network connections to known malicious infrastructure associated with a developer-targeting campaign. The campaign used Vercel for staging and specific IPs for C2.
Detects the execution of 'chmod 000' against PHP files in common FreePBX/Elastix web server directories. This is a high-fidelity indicator of the EncystPHP web shell attempting to lock out administrators and prevent inspection of its malicious files.
Detects a sequence where a service terminates unexpectedly, followed immediately by a process creation from the Service Control Manager (services.exe). This pattern can indicate that a service's recovery options have been configured to run a malicious program upon failure.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
Detects instances where an npm or node process spawns a shell, which in turn executes a command-line networking utility like curl or wget. This behavior is indicative of a malicious pre/post-install script used in supply chain attacks, such as the one seen with the 'ambar-src' package.
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.
Page 100 of 119