Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,091 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects instances where 'node.exe' executes common npm lifecycle scripts (e.g., preinstall, postinstall) that subsequently spawn suspicious child processes such as shell interpreters, network utilities, or scripting engines. This behavior is indicative of malicious packages (such as those associated with the Trum3it campaign) attempting to download or execute secondary payloads during the installation phase.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
This rule detects unauthorized modifications to Firefox registry keys related to the 'SmartWindow' AI feature, specifically identifying instances where the feature is silently enabled without user consent or where the SmartWindow endpoint and API key configurations are redirected to non-standard, potentially malicious URLs. It also monitors for Firefox process executions involving SmartWindow-related arguments, which may indicate exploitation of this browser-based feature.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Detects the execution of the libpwn_cve_2026_55200_server.py Python script, which is identified as a malicious SSH scaffold targeting CVE-2026-55200. This script facilitates exploitation of libssh2 clients by binding to a specific port and delivering malformed packets during the pre-authentication phase.
Detects reconnaissance activities where known binary analysis tools or scripts scan the AnyDesk 9.7.6 runtime binary for specific PE markers (e.g., COM interface IDs, adprinterpipe string) associated with a known LPE vulnerability. This behavior indicates an attacker is fingerprinting the application to prepare for exploitation.
Detects instances where the Windows calculator application (calc.exe) is launched as a child process of suspicious parent applications associated with known proof-of-concept exploits. This detection aims to identify successful exploitation events where calc.exe is used as a payload to demonstrate arbitrary code execution.
Detects instances where ImageMagick (magick.exe, convert.exe, or mogrify.exe) launches a Ghostscript executable (gswin64c.exe, gswin32c.exe, gs.exe, or gsx.exe) from a file path outside of the standard installation directories. This behavior is indicative of a Ghostscript delegate path hijacking exploit, which can be leveraged to achieve arbitrary code execution when processing malicious PostScript (PS/EPS) or PDF files.
Detects nmap processes performing IPv6 scans (using flags such as -6) that result in abnormal process termination or the spawning of unexpected child processes (e.g., cmd.exe, sh, bash). This behavior is indicative of exploitation attempts targeting the nmap IPv6 extension header length integer wrap vulnerability, including the execution of associated PoC harness binaries.
Page 35 of 119