Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,079 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects data exfiltration patterns used by HoneyMyte scripts. The rule monitors for rar.exe compressing files with a specific password or curl.exe uploading data to the Pixeldrain file-sharing service.
Detects a command-line pattern associated with the Metasploit 'getsystem' command. This technique involves echoing a string into a named pipe to elevate privileges to SYSTEM, often executed via a newly created service.
Detects modifications to the RubyGems 'operating_system.rb' file, a technique used by APT37's SNAKEDROPPER malware to achieve persistence by hijacking the Ruby interpreter's execution flow. The rule specifically looks for file creation or modification events on the 'operating_system.rb' file within the RubyGems directory structure, while excluding legitimate 'gem install' operations to reduce false positives.
Detects PowerShell launching RegSvcs.exe, a technique used by TA584 to deliver the 'P0WER' variant of XWorm via process hollowing. The 'P0WER' variant of XWorm uses a custom .NET loader that starts RegSvcs.exe in a suspended state, which is a strong indicator of process hollowing. Legitimate use of RegSvcs.exe by developers is possible but uncommon from PowerShell.
Detects the creation of configuration files (.cfg) in sensitive or temporary Linux directories. This behavior is associated with the GRIDTIDE backdoor, which stages a configuration file containing a key to decrypt its C2 settings.
Detects the Java process, commonly associated with Apache ActiveMQ, spawning certutil.exe to download a file from a remote URL. This behavior is a strong indicator of initial compromise via vulnerabilities like CVE-2023-46604.
Detects network connections to the 10xprofit backend infrastructure. Connections to these domains indicate the presence of a malicious browser extension and potential exfiltration of scraped e-commerce data or tracking activity.
Detects web navigation to Amazon and AliExpress that contains specific hardcoded affiliate tags used by the 10xprofit extension network. The presence of these tags indicates active affiliate hijacking, likely due to a malicious browser extension.
Detects PowerShell executing a self-parsing command to extract a hidden payload from a batch file. This technique was observed in the Dead#Vax campaign. The malware reads its own batch file content to find a line starting with '@' which contains the next-stage encrypted payload.
Detects a Windows Script Host process (wscript.exe or cscript.exe) using WMI to spawn a PowerShell process. This technique is used by malware, such as in the Remcos RAT delivery chain, to break the parent-child process relationship and evade detections based on process ancestry.
Page 104 of 119