Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,076 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the NightLedger DLL search-order hijacking technique where a malicious SspiCli.dll is loaded by the legitimate process AppVShNotify.exe. This rule triggers when SspiCli.dll is loaded from a directory other than the standard Windows System32 or SysWOW64 directories.
Detects malicious Android applications that leverage Accessibility Services for automated interaction. Specifically, the rule monitors for the installation of an app, followed by the immediate enabling of Accessibility Services and subsequent synthetic tap events on the screen within a narrow timeframe. This pattern is characteristic of malware attempting to automatically grant itself sensitive permissions or bypass user consent dialogs, such as the behavior observed in the BTMOB RAT.
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
Detects the execution of insmod or modprobe commands used to manually insert a Linux kernel module (LKM). This behavior is commonly associated with kernel-mode rootkit installation, where adversaries attempt to gain persistence or hide malicious activity from standard system enumeration utilities.
Detects email-delivered URLs and network connections to phishing lure infrastructure masquerading as AWS console or Apple ID/iCloud sign-in pages used to funnel victims into the DarkSword iOS exploit chain.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
Detects specific DLLs associated with the BridgeHead tunneler (a tool attributed to the threat group Mirage Kitten) loading advapi32.dll. This dynamic loading behavior is consistent with the malware attempting to resolve and call the GetUserNameA function to verify the execution environment username, a technique commonly used to detect and evade automated sandbox analysis.
Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.
Page 15 of 119