Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,074 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Detects autoit3.exe invoking process injection Windows APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle) from kernel32.dll targeting the legitimate charmap.exe process, consistent with the AutoIT payload injector chain delivering VIPKeylogger/MedusaHVNC.
Detects Active Directory replication requests (DsGetNcChanges) performed by accounts not identified as Domain Controllers. This behavior is indicative of a DCSync attack, where an adversary uses the directory replication API to extract credentials from Active Directory, potentially leveraging exploited computer accounts.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects the process st.exe (identified as StealC / TrojanPSW:Win32/StealC) executing and subsequently accessing well-known browser credential store artifacts (Login Data, Cookies, key4.db, logins.json, Local State, Web Data) used to harvest stored passwords and session data from browsers.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects Outlook Safe Links redirector URLs that decode to a destination path ending in /js, consistent with a credential-harvesting landing page hosted on a compromised or bystander third-party domain behind the CTA link.
Page 11 of 119