Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects processes attempting to read or copy the Apple Keychain database file (login.keychain-db). Unauthorized access to this file is a strong indicator of credential theft activity, as seen with stealers like AMOS.
Detects a high volume of file renaming operations to the '.ENCRT' extension, combined with the creation of the 'R3ADM3.txt' ransom note by the same process. This behavior is characteristic of the Gunra ransomware encryption routine.
Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.
Detects a process performing rapid, high-volume file system enumeration across multiple drives while deliberately avoiding critical system directories, a behavior consistent with the reconnaissance phase of Gunra ransomware.
Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.
Detects a process requesting read access (GrantedAccess 0x1010) to the LSASS process memory (lsass.exe). This technique is commonly used by threat actors to dump credentials for lateral movement and ransomware deployment. The rule specifically looks for the GrantedAccess value '0x1010', which corresponds to PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access rights, and excludes a list of known legitimate processes.
Detects persistence mechanisms used by the HoneyMyte APT group's CoolClient backdoor. The rule looks for the creation of a specific scheduled task ('ComboxResetTask') or the modification of a registry run key to include the 'work' parameter, which are characteristic of the backdoor's 'passuac' and 'install' routines.
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
Detects the creation of files with a 64-character hexadecimal filename followed by a '.keystore' extension. This is a unique artifact of the Gunra ransomware's 'separate keystore' mode used for storing encryption keys.
Detects the execution of 'osascript' to display a deceptive system dialog box mimicking a 'System Preferences' password prompt. This technique is used by malware like the Atomic macOS Stealer (AMOS) to trick users into entering their administrative password for credential theft.
Page 101 of 119