Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
This rule detects emails originating from Atlassian Jira (specifically the .atlassian.net domain) that contain subject lines associated with a known spam campaign. The campaign uses various lures, including investment scams and online casinos, across multiple languages.
Detects the creation of a scheduled task using schtasks.exe that is triggered by a network connection event (Event ID 10000 from the NetworkProfile provider). This is an unusual persistence technique used by the CRESCENTHARVEST malware to ensure execution only when the machine is online.
Detects the creation of the file 'decrypted_appbound_key.txt' in the AppData\Roaming directory. This file is a specific artifact generated by the CRESCENTHARVEST malware after it successfully decrypts Chrome's app-bound encryption key, indicating browser credential compromise.
Detects the Microsoft Edge WebView2 process (msedgewebview2.exe) being spawned by suspicious parent processes that typically do not use embedded web content, such as PowerShell, CMD, or common lolbins. This activity is a key indicator of the 'AI-Proxy' technique where malware uses WebView2 to programmatically interact with AI web interfaces for C2.
Detects a BeyondTrust (Bomgar) process spawning shell or system administration child processes. This activity is highly indicative of OS command injection, potentially related to the exploitation of CVE-2026-1731.
This rule detects network connections to domains identified as malicious redirectors or landing pages used in a spam campaign that exploited Atlassian Jira. The domains are associated with phishing or malware distribution efforts.
Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for the 'C:\ProgramData\SimpleHelp' directory. This tactic is used by the SimpleHelp RAT to ensure it can operate without permission restrictions and facilitate persistence.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
Page 111 of 119