Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,077 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects Cisco device configuration lines containing weakly protected or plaintext credentials (Type 0 plaintext, Type 4 broken SHA-256, Type 7 Vigenere-cipher passwords) captured in syslog/config backup feeds. These weak hash types are trivially reversible and, once a router config is exfiltrated (e.g., via SNMP/TFTP abuse), allow rapid credential recovery and lateral movement.
This rule detects the creation or presence of a file named 'kbdus1.dll' within the Windows System32 directory. This filename is designed to look like the legitimate Windows keyboard layout DLL 'kbdus.dll' by appending a '1'. Threat actors, specifically associated with the Stupig backdoor, utilize this masquerading technique to blend in with legitimate system files and evade detection by security monitoring tools that rely on filename-based filtering.
This rule detects access to known adversary-in-the-middle (AiTM) phishing infrastructure mimicking Microsoft login pages. It identifies malicious URLs matching specific randomized path token patterns or those hosting a known phishing domain, while also monitoring for associated session-specific parameters such as 'rt=', 'PHPSESSID', and 'preload=1' cookies, as well as traffic interacting with legitimate 'login.microsoftonline.com' domains in a proxy context.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects the HelloNet campaign's persistence technique in which itcsrvup64.exe (ViPNet Update System, part of ViPNet Client) sideloads a malicious wtsapi32.dll from the ViPNet Update System directory to execute a payload at OS startup.
Detects the Cursor IDE (Cursor.exe) executing a process named git.exe from a file path outside of the standard Git installation directory (typically under Program Files). This behavior is indicative of an attacker placing a malicious git.exe binary within a repository directory to facilitate automatic execution and potential command execution when the folder is opened within the IDE, bypassing standard security trust prompts.
Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.
Detects execution of QuarksDumpLocalHash, a tool used to extract local account password hashes directly from the SAM registry hive. This activity is indicative of credential dumping for offline password cracking.
Detects the creation or modification of a Windows service named 'ThumbcacheService', which has been associated with the GoSerpent campaign for file collection. The rule monitors both registry modifications indicative of service installation and process execution patterns using sc.exe, reg.exe, powershell.exe, or cmd.exe that reference this specific service name.
Page 19 of 119