Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,072 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects a shell/interpreter process spawned by a VS Code / VS Code-Insiders editor process that references CI marker environment variable names (GITHUB_, GITHUB_REPOSITORY, GITLAB_CI_, CI_PROJECT_PATH), matching how malicious Open VSX 'evil twin' extensions harvested CI/CD environment variables from GitHub, GitLab, and Azure DevOps runners.
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
Detects msiexec.exe silently installing a ScreenConnect RMM MSI package (ScreenConnect.ClientSetup.msi, WindowsExplorerSupport.msi, SystemCheck.msi) with /qn or /quiet and /norestart flags, correlated with the subsequent drop of ScreenConnect agent binaries (Client.dll, ClientService.dll, WindowsClient.exe, WindowsCredentialProvider.dll) on the same device, indicating unauthorized/unattended RMM agent installation.
Detects signs of Cloudflared tunnel persistence on Windows endpoints, specifically targeting service registration (via sc.exe or registry modifications) and the presence of the cloudflared.exe binary. This is often used by attackers to maintain outbound-only access to compromised machines following exploitation of vulnerabilities like CVE-2026-18577.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
This rule detects a common ClickFix-style social engineering attack pattern used to deploy macOS stealers (like AMOS). It identifies terminal commands where a user is tricked into pasting a base64-encoded string into their shell, which is then decoded using 'openssl base64 -d -A', retrieved via 'curl', and piped directly into 'zsh' for immediate, obfuscated execution.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
Detects process discovery activities (using tasklist.exe, wmic, or Get-Process) performed on a Windows endpoint shortly after an 'MSP Support' account logon, commonly associated with reconnaissance during exploitation of N-able N-central vulnerabilities.
This rule monitors for Microsoft IIS worker processes (w3wp.exe) initiating common command-line shells or scripting engines. This behavior is indicative of successful remote code execution exploitation against internet-facing web applications, such as SharePoint or Telerik UI, often via deserialization vulnerabilities.
Detects inbound emails masquerading as ServiceNow ticket notifications that solicit sensitive information (e.g., vendor IDs, invoice numbers, bank account details) via reply-only body content. This technique evades traditional SEG scanning by avoiding malicious URLs or attachments and leveraging the reputation of legitimate, though spoofed, ServiceNow infrastructure.
Page 7 of 119