Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.
Detects malicious PowerShell activity attempting to bypass the Antimalware Scan Interface (AMSI) by identifying command-line patterns associated with 'CountLoader' and similar malware. It targets the use of .NET reflection to manipulate AmsiUtils fields and the use of dynamic function resolution (D/Invoke) techniques via GetDelegateForFunctionPointer and GetProcAddress to evade static detection.
This rule detects potential ransomware activity by correlating the execution of 'gpscript.exe', which is used to process Group Policy Object (GPO) logon scripts, with subsequent mass file encryption events involving files with the '.SINOBI' extension on the same host within a one-hour window. The rule specifically flags instances where at least five files are encrypted, indicating a high likelihood of a domain-wide ransomware deployment delivered via malicious GPO modification.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
This rule detects the creation or modification of systemd override configuration files, specifically looking for files named 'override.conf' or 'gtwk_module.conf' within directories under '/etc/systemd/system/'. The logic is specifically tuned to identify persistence mechanisms targeting the systemd service manager, including activity associated with the 'rsyslog.service.d' path, which is indicative of the gtwk_module agent attempting to persist across system reboots.
This rule detects persistence mechanisms associated with the CornFlake RAT by identifying three specific activities: the creation of Windows Registry Run or RunOnce keys referencing 'svchost32', the creation of scheduled tasks using 'schtasks.exe' that involve 'svchost32', and a watchdog process pattern where a 'svchost32' process is launched by a parent process that is also identified as 'svchost32'.
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.
Page 13 of 119