Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,077 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the creation or modification of Windows Registry Run keys that point to OCX (ActiveX Control) files located within user-writable AppData directories. This behavior is associated with the persistence mechanisms of various malware families, including TinyEgg, ChonkyChicken, and ChromEggscalator, which often utilize the 'WinComCtl' value name to maintain execution across system reboots.
Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.
Detects the use of rundll32.exe to invoke the MiniDump export function within comsvcs.dll against the lsass.exe process. This technique is commonly used by attackers to dump credential material from memory for offline analysis and credential harvesting.
Detects the CylindricalCanine/GoldenEyeDog credential-theft pattern where the malware first kills a running browser or chat client (Chrome.exe, firefox.exe, skype.exe, 360se.exe, 360chrome.exe, QQBrowser.exe) and then, within a short window, reads/creates the associated credential/profile files (Login Data, avBackup.dat, FormData3.dat, historyUrl3.db, history3.db) on the same device.
Detects credential dumping activity targeting the Local Security Authority Subsystem Service (LSASS) process using mimikatz.exe. This rule monitors for the execution of mimikatz.exe, direct process access (OpenProcess/ProcessAccessedLsass) to lsass.exe by mimikatz, and the spawning of lsass.exe by the mimikatz process, as observed in post-exploitation scenarios following initial backdoor access.
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
Detects the creation of a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) with a specific value name ('MyApp') that invokes mshta.exe to execute a remote HTA file hosted at 'zynaris.io/ru1.hta'. This activity indicates an attempt to achieve persistence by leveraging a legitimate Windows binary (LOLBAS) to run potentially malicious scripts upon user logon, as observed in the SHADOW#REACTOR campaign.
Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.
Detects the installation of the srt64.sys kernel driver, associated with the Daxin rootkit. The detection monitors for the creation of this specific file within the System32\drivers directory and the creation of services referencing the driver file.
Detects a renamed Plink/PuTTY binary (frontpage.exe) launched from C:\users\public\music\ with command-line flags -C -N -R establishing a remote SSH port-forward tunnel to a sftp@ destination on port 3522, consistent with HelloNet C2/data exfiltration tunneling.
Page 18 of 119