Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,091 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects Gitea act_runner processes spawning Docker containers with dangerous configurations, such as privileged mode, host namespace mounts, or security-opt bypasses, followed by the execution of 'nsenter' or shell processes, which are indicative of a container escape attempt to the host.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Detects suspicious PowerShell activity characteristic of the ScreenConnect AsyncRAT campaign, specifically the use of Add-MpPreference to add Windows Defender exclusions for RegAsm.exe and drive roots, and the modification of ConsentPromptBehaviorAdmin to suppress UAC prompts. These actions facilitate process hollowing and malware execution with elevated privileges.
This rule detects potential exploitation of an out-of-bounds write vulnerability in Python's Pillow library (ImageCms module). It identifies Python processes initialized with indicators related to known exploit research (exploitarium) that subsequently terminate with error signals indicative of a crash, such as heap-buffer-overflows or memory management errors, suggesting successful or attempted exploitation.
Detects the execution of Python-based proof-of-concept scripts related to the Pillow ImageCms out-of-bounds write vulnerability. The rule monitors for Python process execution involving specific file paths associated with the PoC, and correlates this with subsequent process crashes or abort signals which are indicative of an exploit attempt resulting in process instability.
Detects the execution of the 'curl' utility with parameters configured to interact with an SMTP server using 'EXPN' or 'VRFY' commands while loading a configuration file via the '-K' flag. This pattern is indicative of an attempt to exploit CVEs or software vulnerabilities that are susceptible to CRLF injection within SMTP recipient fields, potentially leading to unauthorized mail relaying or protocol manipulation.
This rule detects the exploitation of CVE-2026-48558 in SimpleHelp, where an OIDC authentication bypass allows unauthenticated attackers to forge identity tokens. The lack of cryptographic signature verification permits the registration of unauthorized, privileged Technician accounts, effectively bypassing MFA. The detection logic monitors for specific log patterns indicating OIDC response processing followed by technician account registration and configuration changes.
Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.
Detects the use of certutil.exe to decode a base64-encoded file named Link.dat into an executable VBScript payload named Link.ini, specifically within the %USERPROFILE%\Links directory. This behavior is indicative of Kimsuky infection chains where malicious CHM files or MSHTA scripts trigger secondary payloads.
Detects the execution of 'unshare' with flags (such as --user/--net or CLONE_NEWUSER/CLONE_NEWNET) by unprivileged users. This behavior is indicative of attempts to gain CAP_NET_ADMIN capabilities within a new namespace, a necessary precursor to exploiting the pedit COW (CVE-2026-46331) vulnerability for privilege escalation.
Page 33 of 119