Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
Detects outbound network traffic to a known Atomic macOS Stealer (AMOS) command and control (C2) server. This activity is associated with the exfiltration of stolen data, such as credentials, browser data, and system information, compressed into a ZIP archive.
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
This rule detects modifications to AI assistant configuration files by suspicious processes like package managers (npm, yarn) or shell interpreters (bash, powershell). This activity is indicative of a supply chain attack, specifically the SANDWORM_MODE campaign, where an attacker injects a rogue Model Context Protocol (MCP) server entry to hijack AI tools. This enables automated source code and secret theft via prompt injection.
Detects the presence of files matching the SHA256 hashes of known RESURGE malware components, including the main 'libdsupgrade.so' library, the 'liblogblock.so' log tamperer, and the 'dsmain' utility. This rule identifies the creation or modification of these specific files on a device.
Detects a process with a short, alphanumeric filename executing from the /var/tmp/ directory and spawning a shell. This behavior is associated with the GRIDTIDE backdoor, which uses this technique for post-compromise reconnaissance and execution.
Detects Microsoft PowerPoint spawning a command-line interpreter (cmd.exe or powershell.exe) to perform suspicious file operations. This behavior was observed in an APT36 campaign where a malicious PowerPoint Add-in (.ppam) was used to create staging directories and extract embedded payloads.
Detects LOLBin processes (mshta.exe, wscript.exe, cscript.exe) making outbound network connections to non-standard ports. This behavior is characteristic of the PeckBirdy framework's C2 communication.
This rule detects the execution of multiple distinct commands used to inhibit system recovery on a single host within a short time window. This behavior is a strong indicator of ransomware or other destructive malware attempting to prevent system restoration.
Detects the execution or presence of files associated with the Muddled Libra threat actor's toolkit. This includes tools for tunneling (Chisel), Active Directory reconnaissance (ADRecon, ADExplorer), and the initial tool archive (goon.zip). The rule identifies process execution by hash, filename, or command line arguments, and file creation events for specific hashes.
Page 102 of 119