Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,074 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects schtasks.exe being used to create a new scheduled task that points to an updater/downloader binary located under %APPDATA% or %LOCALAPPDATA%, consistent with SilentMare's persistence mechanism established by its installer to run the updater once per day.
Detects PowerShell command lines that use reflection to access the AmsiUtils class and set the amsiInitFailed field to true, a well-known technique to disable AMSI scanning for the remainder of the session before executing malicious payloads.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Detects the creation of an app-specific password named 'ZimbraWeb' using the CreateAppSpecificPasswordRequest SOAP command in Zimbra logs. This technique is used to maintain persistent access to mailboxes while bypassing multi-factor authentication (MFA).
Detects unauthorized access or staging operations on the C:\Windows\debug\NetSetup.log file. This activity is often associated with the NightLedger tool, which collects this diagnostic log alongside process listings for potential exfiltration. The rule filters out legitimate system processes that typically interact with this file during domain or workgroup join operations.
Detects osascript executing AppleScript containing 'do shell script ... with administrator privileges' to elevate execution, where the osascript process was spawned by a non-shell parent process, consistent with the EtherHiding macOS loader technique.
Detects execution of the LegacyHive proof-of-concept (PoC) binary or its unique command-line indicators. LegacyHive exploits a Windows User Profile Service vulnerability to perform arbitrary registry hive loading, which can be utilized for privilege escalation.
Detects the invocation of cmd.exe using the specific non-standard flag combination '/e:ON /v:OFF /d /c'. This command pattern is associated with the msaRAT implant, which leverages these flags to execute commands received via browser-mediated C2 channels (WebRTC/CDP).
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Detects PHP process execution invoking fsockopen() to establish an outbound reverse shell connection, consistent with SpyPress backdoor persistence mechanisms deployed by TA458 on compromised Roundcube webmail servers.
Page 16 of 119