Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
Detects processes launched by Windows Explorer where the command line contains excessive whitespace or hidden control characters. This pattern is indicative of CVE-2025-9491, a technique used to hide malicious arguments from the LNK Properties dialog.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
Detects a command-line pattern where nslookup is used to query a DNS server, and its output is piped to other commands to parse and execute a payload. This is a technique used by ClickFix campaigns to deliver malware via DNS.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
This detection identifies the use of the 'kill' command with a specific, non-standard real-time signal (-59). Rootkits like 'Singularity' use these 'magic' signals as an out-of-band communication channel to trigger actions within a malicious kernel module, such as toggling stealth features or granting root privileges.
Detects the creation of files in specific staging directories used by the CRESCENTHARVEST malware for collecting keylogs, browser data, and Telegram sessions before exfiltration. The rule specifically looks for 'daT.txt' in 'spool\Drivers\color', and any file creation within '\Windows\Temp\sysdriver\' or '\Windows\Temp\tdata\'.
Detects potential spam campaigns originating from disposable or trial Jira Cloud instances with randomized subdomain names. The rule identifies emails from '.atlassian.net' domains where the subdomain is longer than 12 characters and contains a mix of letters and numbers, indicating a potentially randomized or disposable instance. It then alerts if more than 5 emails with the same subject are sent from such a suspicious subdomain.
Page 109 of 119