Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,071 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the execution of an unsigned binary under a non-SYSTEM user context that directly spawns 'whoami.exe' which then runs as the SYSTEM account. This behavioral pattern is indicative of a successful local privilege escalation exploitation, where a malicious binary confirms its escalation by querying the current user identity in a SYSTEM shell. The rule includes exclusions for common administrative agents, such as the Microsoft Intune Management Extension, that may exhibit similar behavior due to periodic detection scripting.
Detects unauthenticated WordPress administrator account takeover attempts targeting the User Profile Builder plugin. The rule identifies inbound HTTP GET requests containing the 'autologin=true' parameter and a forged '_wpnonce' value matching the 'autologin-1-' pattern, which exploits an authentication bypass vulnerability (CVE-2026-15826) to gain unauthorized session access as user ID 1.
Detects execution of a process matching the reverse_ssh client naming pattern followed by an outbound network connection, consistent with the open-source reverse_ssh tool establishing an outbound reverse SSH tunnel for C2/remote access.
This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.
This rule detects potential exploitation of CVE-2026-15826, an authentication bypass vulnerability in the WordPress User Profile Builder plugin. It monitors HTTP POST requests to 'admin-ajax.php' or the 'profile-builder' endpoint for username parameters between 61 and 70 characters long, which is a known exploit condition for triggering a type confusion in the wppb_log_in_user() function that could allow unauthorized access as user ID 1.
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
Detects the creation and configuration of a Windows service named 'media_updaten' via command-line utilities (sc.exe) or direct registry modification. This service is associated with CoolClient for persistence to relaunch 'Sang.exe' with a 'work' parameter.
This rule detects the addition of TXT or CNAME records within Azure-managed DNS zones that correspond to third-party email sending platforms, specifically Amazon SES or Resend. It monitors for the creation of DKIM selectors or SPF records that authorize these services to send emails on behalf of the organization's domain, which can be used to facilitate email spoofing or phishing.
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
Detects module or image load events where the image lacks an associated on-disk path (FolderPath is empty). This behavior is indicative of in-memory code loading, such as reflective loading or the execution of Beacon Object Files (BOFs), where malicious code is mapped directly into process memory rather than loaded via the standard OS image loader.
Page 5 of 119