Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,091 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
This rule monitors SIEM-ingested HTTP or API gateway traffic for JSON Web Tokens (JWT) where the base64url-encoded payload claims contain sensitive identifiers such as 'password' or 'role'. Detection of these fields in unencrypted JWT claims indicates poor development practices leading to excessive data exposure or potential credential leakage within web session management.
Detects a sequence of failed authentication attempts potentially indicative of an offline JWT secret brute-force attack (using tools like jwt_tool), followed by a successful authentication from the same source. This pattern suggests the adversary successfully recovered the secret, forged a valid token, and subsequently used it to gain unauthorized access.
Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.
Detects the creation of files named 'WC3' or 'wt1' within the 'C:\ProgramData' directory. These filenames are associated with the UAC-0226 threat actor's delivery chain, specifically involving an encoded PowerShell loader (WC3) and an arithmetic-encoded GIFTEDCROOK payload (wt1). These files are typically dropped via path traversal exploitation (CVE-2025-8088) using WinRAR NTFS alternate data streams.
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
Detects Akira ransomware-associated PowerShell script execution that attempts to terminate backup, virtualization, and database services (such as VMware, Veeam, Hyper-V, and MSSQL) and inhibit system recovery by deleting Volume Shadow Copies or disabling boot recovery features.
Detects DLL side-loading where the signed Tencent UxEnhanceHost binary loads a malicious UxEnhance64.dll from randomized staging directories under C:\Users\Public\, a primary execution vehicle in the SilverFox campaign.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects Python processes (potentially associated with the ChocoPoC RAT, slogsec, or logcrypt modules) performing file read or access operations against common browser credential store files such as Login Data, Cookies, and Web Data on Windows and macOS systems.
Page 32 of 119