Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,082 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Detects a single authenticated user account or client performing a high volume of requests to sequential object IDs on the same API path within a short window. This pattern is characteristic of Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) exploitation, where an attacker attempts to gain unauthorized access to data records that do not belong to them by iterating through predictable numeric identifiers.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects mpr.dll loaded by non-standard processes followed by an SMB (port 445) connection from the same process, consistent with Cavern Manticore's WNetAddConnection2 routine that lazily resolves the API via P/Invoke (bypassing the static import table) and marshals stolen credentials to authenticate to remote network resources.
Detects rapid SMB (port 445) connect/disconnect patterns originating from processes that have loaded mpr.dll. This behavior is indicative of credential spraying tools, such as the Cavern Manticore NetUseBrute module, which utilizes WNetAddConnection2 and WNetCancelConnection2 to cycle through credentials against multiple endpoints.
Detects the persistence and execution mechanism of ChocoPoC RAT, where a Python interpreter is spawned in a hidden window using the CREATE_NO_WINDOW flag (0x08000000). The rule monitors command-line arguments and parent-child process relationships for indicators of the RAT's module import, specific environment variables used for anti-recursion loops, and process spawns originating from existing Python instances.
Detects the DOGLEASH backdoor utilizing /bin/sh -c to execute arbitrary shell commands. The detection specifically looks for the execution of the Unix shell with -c arguments triggered by parent process command lines containing specific C2 command codes (0x2268 or 0x2267).
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.
Detects high-volume password spraying attempts targeting Microsoft 365, originating from the LSHIY LLC IPv6 address space (2a0a:d683::/32). The rule monitors for failed sign-ins using the OAuth ROPC flow via Azure CLI or similar tools, identifying high counts of distinct accounts targeted within a short time frame.
Page 26 of 119