Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the execution of csc.exe (the C# command-line compiler) with specific command-line arguments (/noconfig, /fullpaths) and a response file (.cmdline) located within a temporary directory. This pattern is commonly associated with fileless malware, such as Banana RAT, which compiles its components at runtime to bypass static file-based detection.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects high volumes of file download operations from OneDrive or SharePoint occurring within one hour of a device-code authentication event. This pattern is indicative of potential data exfiltration by an adversary using a stolen access token obtained via an OAuth device-code phishing attack.
This rule detects successful Azure AD sign-in events (ResultType 0) that occur following a series of repeated failed sign-in attempts (ResultType 50126) from the same user account. The activity is specifically scoped to the LSHIY IPv6 address range and utilizes Azure CLI or similar mobile/desktop client applications, which is a strong indicator of an automated password spraying or credential stuffing attack followed by a successful compromise.
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
Detects a process tree where Code.exe (VS Code) spawns node.exe as an intermediary process, which in turn spawns calc.exe. This matches the child_process.exec execution pattern observed when a malicious VS Code extension dependency decodes and runs an arbitrary command, demonstrating that any payload (not just calc.exe) can be executed via this chain.
Detects the execution of PowerShell with typical reverse shell command-line flags (-nop, -w hidden, -c) launched as a child process of cmd.exe. This pattern is commonly associated with remote code execution (RCE) scenarios, such as the exploitation of vulnerable applications that inject keystrokes or system commands via unauthenticated interfaces.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Page 24 of 119