Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,079 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects outbound HTTPS traffic to specific URI paths and User-Agent strings hardcoded in MIMICRAT's malleable C2 profiles. These profiles impersonate legitimate web analytics traffic.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
This rule identifies network connections to known command and control (C2) infrastructure and typosquatted domains associated with the ValleyRAT malware, specifically those used in the Huorong impersonation campaign. It looks for connections to a hardcoded malicious IP address or a list of malicious domains.
Identifies the loading of a Linux kernel module from a suspicious, non-standard directory such as /tmp, /dev/shm, /var/tmp, or a user's local hidden directory. Attackers often deploy rootkits and other kernel-level malware from these locations to evade detection and gain persistence. This technique is a prerequisite for kernel-level bypasses like those used by the 'Singularity' rootkit.
Detects DNS queries to known OAST (Out-of-Band Application Security Testing) domains like oastify.com, oast.pro, and oast.fun where the subdomain is unusually long (over 50 characters). Long subdomains may indicate encoded data exfiltration, a technique observed in the exploitation of vulnerabilities like CVE-2026-1731 to bypass egress filtering.
Detects the creation or execution of a scheduled task named 'Batteries' pointing to the AppData Roaming directory, which is a specific persistence mechanism for the ValleyRAT campaign. This rule identifies the creation of the scheduled task via 'schtasks.exe', the creation of the legacy '.job' file for the task, or the execution of the payload 'WavesSvc64.exe' from its persistence location.
Detects the execution of an executable from a subdirectory under %ProgramData% that matches the 'knz_' naming convention used by the MIMICRAT loader. MIMICRAT uses this directory to stage its Lua-based loader (zbuild.exe). The rule specifically looks for unsigned executables to reduce false positives.
Detects standalone execution of the malicious NCrypt.dll using rundll32.exe with its exported ordinal #1, a behavior observed in sandbox analysis that bypasses standard NuGet loading.
Detects the creation or modification of a Windows service named 'BluetoothService' where its executable path points to a non-standard, user-writable location (e.g., AppData, Temp, ProgramData). This technique is often used by malware, such as the Chrysalis backdoor in the Lotus Blossom campaign, to establish persistence and evade detection by masquerading as a legitimate system service.
Detects PowerShell scripts using .NET Reflection to modify internal fields to disable Event Tracing for Windows (ETW) or the Anti-Malware Scan Interface (AMSI). This technique is used by malware like the MIMICRAT loader to evade defenses before executing its main payload.
Page 107 of 119