Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,089 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
This rule detects unauthorized access attempts to common cryptocurrency wallet data files and Telegram Desktop session information, a pattern of behavior consistent with the data collection phase of the Vidar information stealer.
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Detects persistence mechanisms used by the Mustang Panda threat actor (specifically the SHARDLOADER/ZOHOMURK malware variants). The rule monitors for the creation or modification of Windows Run registry keys using specific, known malicious value names (e.g., 'MediumNetMonIt', 'MicrosoftEdgeUpdateBrokerTask') or pointing to suspicious file paths located in 'C:\ProgramData\IDM\logs\' or within the 'VaultCache' folder.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects outbound SSH connections to TCP port 2222 that exhibit specific cipher negotiation patterns (curve25519-sha256 and chacha20-poly1305@openssh.com) associated with a known malicious SSH server exploit scaffold for CVE-2026-55200. This vulnerability involves a pre-authentication heap out-of-bounds write in libssh2 clients.
Detects the installation of known malicious npm packages designed to impersonate the legitimate 'rollup-plugin-polyfill-node' dependency. This pattern is associated with Lazarus Group supply chain attacks targeting developer environments and CI/CD pipelines.
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects the use of reg.exe to save the HKLM\SAM registry hive to a file path outside of standard system directories. This behavior is indicative of credential dumping attempts, where adversaries attempt to bypass endpoint security behavioral detection rules that monitor for SAM file access in common locations by using alternative, potentially allowlisted paths.
Page 30 of 119