Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the execution of SharpDPAPI with command-line arguments designed to perform machine-scoped DPAPI masterkey and certificate recovery. This behavior is often associated with credential theft, particularly the extraction of sensitive secrets like ADFS token-signing keys or machine credentials stored in the DPAPI system.
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
Detects Microsoft Exchange EWS/OWA HTTP requests containing URL-encoded file scheme indicators (e.g., 'file%3a', '%66%69%6c%65'). This activity is associated with attempts to bypass security filters via scheme smuggling, potentially to facilitate Server-Side Request Forgery (SSRF) exploitation leading to unauthorized local file access.
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Detects a node.exe process spawned by VS Code (Code.exe) performing sandbox/CI-CD evasion checks associated with the malicious @jaymara/jsononifier npm dependency, including a filesystem existence check for '/.dockerenv' or file access under a folder path referencing the @jaymara/jsononifier package prior to XOR-decoded payload execution.
Detects an infostealer-style remote injection chain where a non-browser process allocates memory, writes a DLL path, and creates a remote thread pointing at kernel32!LoadLibraryW inside chrome.exe, msedge.exe, brave.exe, or firefox.exe. This suspend-inject-resume pattern is used by WEES Stealer to load its payload DLL into a browser process before intercepting App-Bound key material.
Detects high-volume or multi-account failed LDAP simple-bind authentication attempts against the Active Directory Global Catalog port (3268). This behavior is consistent with automated password spraying or brute-force tools, such as the Cavern Manticore LdapBrute module, which attempt to validate credentials across multiple accounts.
Page 25 of 119