Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects outbound network connections to known command-and-control (C2) and payload delivery infrastructure associated with the Rekoobe campaign. The rule specifically looks for connections to the IP address 154.84.63.184 or domains img.spoolsv.cc, img.spoolsv.net, spoolsv.cc, and spoolsv.net.
Detects the creation of a Ruby runtime environment in unusual ProgramData subdirectories and the renaming of the Ruby interpreter to masquerade as a USB utility, a technique used by APT37's SNAKEDROPPER malware. Specifically looks for file events in 'C:\ProgramData\usbspeed' or 'C:\ProgramData\ruby3' where the filename is 'usbspeed.exe' or the previous filename was 'rubyw.exe'.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
Detects the creation of the covert socket file '/home/runtime/tmp/.logsrv', which is used by the RESURGE malware as a communication bridge between its hooked 'web' process and its 'dsmdm' SSH component on Ivanti Connect Secure devices.
Detects the creation of a scheduled task configured to execute a VBScript from a user's AppData folder. This technique is used by adversaries, including the Dead#Vax campaign, to establish persistence via an indirect execution flow, often to evade detections focused on direct PowerShell or cmd.exe task actions.
Detects the execution of legitimate Windows binaries from suspicious public or shared locations, a technique used by the Dohdoor malware campaign to sideload a malicious DLL.
Detects a Node.js process accessing sensitive files such as environment configuration files (.env) or browser credential/session stores. This behavior was observed in a developer-targeting campaign where attackers exfiltrated secrets from compromised developer machines.
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
Detects the execution of legitimate .NET framework utilities (Aspnet_compiler.exe, RegAsm.exe, vbc.exe) launched by scripting engines like PowerShell or WScript. This behavior is a known TTP for process hollowing, as seen in Agent Tesla campaigns, where malware injects its code into a trusted process to evade defenses.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Page 103 of 119