Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.
This rule detects potential ransomware activity by monitoring for a high volume (exceeding 20 occurrences within a 5-minute window) of file rename, modification, or creation events associated with the '.sinobi' file extension. The logic aggregates these events by device and account to identify patterns consistent with mass file encryption, mapping to the MITRE ATT&CK T1486 (Data Encrypted for Impact) technique.
Detects User Account Control (UAC) bypass techniques associated with ChocoShell. The rule monitors for specific malicious patterns: the execution of 'schtasks.exe' to trigger the 'SilentCleanup' task, the spawning of unexpected child processes from 'wsreset.exe' or 'sdclt.exe', and the invocation of 'sdclt.exe' with the '/KickOffElev' argument. These behaviors are indicative of an attacker attempting to elevate privileges by abusing Windows auto-elevating binaries.
Detects an editor/extension-host process (not git.exe) reading multiple internal Git repository files (.git/config, .git/HEAD, .gitconfig) within a short window, matching malicious extensions parsing repo remote URLs, branch/commit info, and commit email domains without invoking the git binary.
Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.
Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.
Detects GitHub issue/PR comments attributed to the adk-bot service account that contain privileged workflow-trigger strings ('@gemini-cli' or '/adk-issue-fix'). The CI authorization gate validates only the commenter's account identity, not whether the trusted bot account was manipulated via prompt injection into posting the trigger itself, so any adk-bot comment containing these strings is a candidate forged bridge into maintainer-only automation.
Detects the AutoIT payload injector multi-stage execution chain (wscript.exe -> powershell.exe -> cmd.exe -> powershell.exe -> autoit3.exe -> charmap.exe) used to deliver VIPKeylogger and MedusaHVNC, culminating in process injection into the legitimate charmap.exe utility.
Page 12 of 119