Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This detection identifies the execution of iptables commands used to implement Single Packet Authorization (SPA). This technique was observed being used by UNC6201 on compromised VMware appliances to create stealthy, conditional network proxies for C2 traffic. The rule looks for specific command-line arguments indicative of SPA setup, including rules for 'magic packet' detection, dynamic IP list management using the 'recent' module, and traffic redirection.
Detects file activity associated with the LunarApplication malware, either by the known installer hash or by creation of files/directories within its installation path. This rule combines a high-fidelity hash with a specific folder path.
Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.
Detects the creation of JSON files within the '%LOCALAPPDATA%\Arkanix_lol\' directory. This folder is used by the Arkanix Stealer to stage stolen data before exfiltration, making this activity a strong indicator of infection.
This rule detects the execution of processes associated with a JWrapper-packaged SimpleHelp Remote Access Trojan (RAT). The execution from the specific 'ProgramData\JWrapper-Remote Access' directory is a strong indicator of the malicious activity described in the Cofense report. The rule specifically looks for 'Remote AccessWinLauncher.exe', 'windowslauncher.exe', and 'winpty-agent64.exe' being executed from 'C:\ProgramData\JWrapper-Remote Access'.
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
Detects the creation of a Windows service followed by the use of "sc.exe sdset" to apply a highly restrictive security descriptor. This specific TTP is used by the REF4033 group (UAT-8099) to harden their malicious 'WalletServiceInfo' service, making it difficult for administrators to stop or delete.
Detects the creation or execution of files, often in C:\ProgramData, with a file description of 'SimpleHelp Remote Access Client' but using non-standard or renamed filenames. This is indicative of threat actors deploying the SimpleHelp RMM tool for persistence, as observed in campaigns exploiting CVE-2026-1731 in BeyondTrust.
Detects the execution of CbsMsgApi.exe, which is the initial loader used by the REF4033 group to install the BADIIS IIS module and create a persistence service. The detection is based on the specific filename or the known imphash of the loader.
Page 112 of 119