Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,089 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
Detects unauthorized attempts to access or extract Redis credentials from the Argo CD repo-server process. The detection identifies suspicious command-line activity where environment variables are enumerated (via env or printenv) or sensitive configuration files (/etc/argocd) are accessed by the repo-server process or its children. This behavior is indicative of an attacker attempting to exploit unauthenticated gRPC vulnerabilities to steal credentials for cache poisoning or further lateral movement within a containerized environment.
Detects the use of PowerShell to forcefully terminate 'wscript.exe' using 'Stop-Process' or 'taskkill'. This behavior is associated with adversaries, such as those in the VEIL#DROP campaign, attempting to minimize forensic evidence after executing malicious JavaScript lures via Windows Script Host.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects TeamPCP-associated behavior in CI/CD environments, specifically the encryption and staging of sensitive secrets using tools like OpenSSL, tar, and curl. The rule monitors for the execution of at least three distinct tools from a specified list within a short time window that interact with files in a /tmp/tmp. staging directory, indicative of preparation for data exfiltration.
Detects suspicious execution patterns on CI/CD runners involving the decoding of base64-encoded payloads piped into sudo python3, which is often used for credential harvesting. The rule identifies this behavior through two methods: sibling process correlation where 'base64 -d' and 'sudo python3' occur within 60 seconds of each other, and the observation of interpreters (sh, bash, python, etc.) launched without arguments in conjunction with runner-specific process patterns, indicative of stdin-piped execution.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects the presence of file system artifacts associated with the malicious Chromium extension 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd) on an endpoint. This extension is known to perform search hijacking and keystroke exfiltration.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Page 28 of 119