Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,079 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.
Detects the creation of a scheduled task via PowerShell using 'Register-ScheduledTask' configured to run as the SYSTEM account at system startup. The detection specifically identifies tasks with dynamically generated hexadecimal names (8-20 characters), a technique associated with the persistence mechanism of Banana RAT.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
This rule detects attempts to directly access and modify raw disk devices, a technique commonly used by wiper malware like GigaWiper. It monitors for operations involving raw physical disk paths (e.g., \\.\PhysicalDrive) in conjunction with strings indicative of disk destructive routines such as partition removal, disk creation IOCTLs, or raw drive handle manipulation.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
Detects Entra ID sign-in failures with error code AADSTS500172, indicating that a federated SAML assertion was rejected due to invalid or stale token-signing material. This may indicate an attempt to use a forged or recovered SAML token (e.g., Golden SAML) where the signing key is no longer valid or recognized.
Detects a Node.js process spawning a detached child process that executes a script named 'caller.js'. This behavior is consistent with the 'nodemon-sudo' or 'tslint-conf' supply chain attacks, which leverage detached child processes to execute malicious second-stage payloads while suppressing console output, effectively creating a persistent, hidden backdoor.
Identifies Linux systems acting as KVM hypervisors that are running kernels vulnerable to CVE-2026-53359 (Januscape), a use-after-free vulnerability in the shadow MMU (arch/x86/kvm/mmu/mmu.c). This vulnerability permits a guest virtual machine to escape into the underlying host environment, potentially compromising the hypervisor and other hosted workloads.
This rule detects potential Active Directory Certificate Services (ADCS) ESC17 abuse by monitoring for certificate requests that contain a Subject Alternative Name (SAN) or Common Name (CN) matching trusted external domains such as 'login.microsoftonline.com'. It also monitors for Certipy command-line activity targeting insecure web server templates or attempting ESC17-specific maneuvers, which indicates an attempt to forge certificates for domain impersonation or unauthorized authentication.
Page 22 of 119