Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,071 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
Detects instances where the Windows Defender antimalware service (MsMpEng.exe) spawns common shell processes (cmd.exe, powershell.exe, pwsh.exe, or conhost.exe) while running under the SYSTEM account. This behavior is highly anomalous and indicative of potential exploitation involving privilege escalation via the Microsoft Defender process.
Detects the execution of cmd.exe as a child process of the IIS worker process (w3wp.exe) when the worker process is associated with an Exchange application pool. This pattern is indicative of a webshell exploiting an ASPX component to execute arbitrary commands on an Exchange Server.
This rule detects privilege escalation attempts by monitoring for cmd.exe, powershell.exe, or whoami.exe processes executing with SYSTEM privileges that were spawned by a non-SYSTEM user. It correlates these events with concurrent activity from the Microsoft Defender service (MsMpEng.exe) within a five-minute window, identifying a behavioral pattern consistent with the ShieldBreak (CVE-2026-50656) exploit chain, which leverages Defender to facilitate token elevation.
Detects an Exchange server initiating outbound SMB (port 445) connections to non-private (external) IP addresses. This behavior is highly characteristic of PetitPotam (MS-EFSR) coercion, where an attacker forces the server to authenticate to an external, attacker-controlled UNC path to capture NTLM authentication credentials or relay them to other network resources.
Detects the addition of a Microsoft Defender exclusion path targeting suspicious directories or executables that mimic legitimate Windows Defender installation paths (e.g., 'Microsoft\Windows Defender' or 'defender.exe'). This behavior is indicative of defense evasion, allowing attackers to hide malicious files from real-time scanning by bypassing security controls via PowerShell Set-MpPreference or WMIC.
Detects DLL sideloading behavior where a process named defender.exe, located in a directory mimicking the Windows Defender installation path, loads specific DLLs (libngs.dll or libsrapc.dll) associated with the HoneyMyte actor's CoolClient malware.
Detects potential command injection on GitHub Actions self-hosted runners where a child shell process (bash/sh) is spawned by the Runner.Worker or Runner.Listener processes. The rule looks for a specific pattern of shell command lines containing single quotes, semicolons, and the 'echo' command, which is indicative of a breakout attack exploiting unsanitized GitHub event data (e.g., issue titles) being passed into shell commands.
This rule detects instances of VS Code, code-server, or associated Node.js processes executing 'git config --get user.email'. This behavior is characteristic of malicious VS Code extensions (specifically 'evil-twin' extensions) attempting to perform developer reconnaissance by harvesting local Git identity information, which can then be exfiltrated.
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
Page 2 of 119