Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,079 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects anomalous SOAP requests to 'GetScratchCodesRequest' within the 'zimbraSync' or 'zimbraAccount' namespaces in Zimbra logs. This activity is indicative of credential harvesting attempts, specifically the exfiltration of 2FA recovery scratch codes, often associated with the ZimReaper/Ulej payload used by threat actors.
Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.
Detects a non-browser process establishing a loopback connection to a Chrome or Edge remote-debugging (CDP) endpoint. Malicious processes may abuse the Chrome DevTools Protocol to drive a headless browser, allowing the attacker to perform browser-based actions or use the browser as a covert C2 channel. This rule monitors for HTTP requests to /json/list/ or /devtools/ on 127.0.0.1 originating from processes other than chrome.exe or msedge.exe.
Detects SilentMare beachhead installers that add an HKCU CurrentVersion\Uninstall registry entry and create a desktop shortcut within a short time window, mimicking legitimate software installation to mask the hidden updater/beachhead component.
Detects the mounting of a registry hive into an HKEY_USERS Classes root where the SID embedded in the registry key path does not match the SID of the process account that initiated the operation. This behavior is associated with the 'LegacyHive' exploitation technique, where an attacker attempts to mount another user's (or administrator's) registry hive into their own context to facilitate privilege escalation.
Detects osascript process execution spawned by launchd/LaunchAgent chains where the invoked AppleScript command line contains obfuscated/encoded content, consistent with EtherHiding's Launch Agent-triggered AppleScript payloads used to query blockchain C2 infrastructure.
Detects instances where notepad.exe is executed with a security context (AccountName) that differs from the initiating process's account (InitiatingProcessAccountName). This pattern is consistent with the LegacyHive technique, which utilizes CreateProcessWithLogonW to load a target user's registry hive by spawning a suspended process as that user.
Detects the execution of specific OCX files (updater.ocx, chromelevator.ocx, mscom.ocx, koki.ocx, or agent.ocx) using regsvr32.exe from user-writable directories like Temp or AppData, a behavior associated with the TinyEgg/ChonkyChicken/ChromEggscalator malware families.
Detects the use of the native Windows registry utility 'reg.exe' to save or export the Security Account Manager (SAM) or SYSTEM registry hives to disk. This technique is a common precursor to credential theft, where attackers dump the SAM database to perform offline password cracking. This pattern has been observed in various adversary operations, including ransomware campaigns, to facilitate privilege escalation and lateral movement.
Detects the mrmustard supply-chain implant establishing persistence by writing a crontab entry that invokes the compiled stealer 'hw_probe.pyc' every 15 minutes, or direct crontab command invocation referencing the file.
Page 17 of 119