Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,079 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the presence or execution of known TeamPCP malware and infrastructure tools (proxy.sh, kube.py, pcpcat.py, and tunneling tools like FRPS/gost) based on their MD5 file hashes. The group uses these standardized payloads to automate their operations.
Detects network traffic to a local proxy on port 7152, a behavior associated with a malicious NuGet package campaign involving NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_. This traffic is characterized by communication to a loopback address (127.0.0.1 or ::1) or 'localhost' on the suspicious port, specifically targeting '/api/auth/' endpoints.
Detects the creation of files matching SHA256 hashes of known malware (SparkRAT, VShell, webshells) observed in the CVE-2026-1731 exploitation campaign. This rule specifically looks for file creation events where the SHA256 hash of the created file matches one of the predefined malware hashes.
Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
Identifies network connections or DNS queries to known phishing domains mimicking Windows 11 update sites, which are used to distribute infostealer malware. These domains are highly specific to this campaign.
Detects the execution of common Living Off The Land Binaries and Scripts (LOLBAS) initiated from Windows Explorer. The detection logic specifically looks for command lines that contain indicators of obfuscation or padding, which are common techniques used in malicious LNK (shortcut) files to hide their true purpose. This rule identifies processes like mshta.exe, powershell.exe, cmd.exe, certutil.exe, cscript.exe, and wscript.exe being launched by explorer.exe with suspicious command-line arguments.
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
Detects the execution of executables that masquerade as common collaboration tools (e.g., Teams, Zoom, Adobe) but have characteristics of the TrustConnect RAT. TrustConnect uses large (approx. 35MB) .NET Core single-file executables where the internal/original filename is a .dll, which is a mismatch from the .exe process name.
Page 108 of 119