Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,074 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the creation of specific persistence artifacts (a VBScript file and a startup shortcut) associated with the ModeloRAT payload delivered by recent ClickFix campaigns. Specifically, it looks for a VBScript file at '\WPy64-31401\python\script.vbs' or a shortcut file named 'MonitoringService.lnk' in a user's startup folder.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects the execution of the deprecated Google 'software_reporter_tool.exe' from suspicious user-writable directories. This technique is used by the CRESCENTHARVEST malware campaign to perform DLL sideloading using a signed, but deprecated, binary to evade defenses.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects modifications to the Text Input Processor (TIP) registry key with unusually large binary data, which can be indicative of malware hiding persistent code. This specific registry key is not commonly used for storing large amounts of data, making large writes suspicious.
Detects modification of the IIS global configuration file (applicationHost.config) by a process outside of the standard inetsrv directory. This is the primary method BADIIS malware uses to register its malicious module and intercept web traffic.
This detection identifies modifications to the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This script is executed at boot time and was observed being modified by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
Detects network connections or DNS queries to domains and IP addresses identified as payload delivery and C2 infrastructure for a JWrapper/SimpleHelp RAT campaign. Monitoring these indicators can help detect initial compromise or ongoing C2 communication.
Detects the use of a specific PowerShell command pattern using the '[adsiSearcher]' type accelerator to enumerate and count computer objects in Active Directory. This technique was observed being used for discovery in campaigns following the exploitation of CVE-2026-1731 (BeyondTrust).
Page 110 of 119