Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,091 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the creation of a scheduled task named 'WindowsHelper', which is used by Operation HumanitarianBait for persistence to launch its Python implant every 5 minutes. This rule specifically looks for command-line executions of 'schtasks.exe' or commands containing 'schtasks' that include '/create' and the task name 'WindowsHelper'.
This rule detects suspicious child processes spawned by the BeyondTrust Remote Support client (bomgar-scc), which could indicate post-exploitation activity following a compromise via vulnerabilities like CVE-2026-1731. It looks for high-risk command line patterns and suspicious child processes commonly used for reconnaissance and payload execution.
Detects the execution of 'module.pyw' using 'pythonw.exe', which is a technique employed by Operation HumanitarianBait to silently run an infostealer. This rule specifically targets the combination of the windowless Python interpreter and the known payload script name.
Detects cmd.exe spawning PowerShell to download a file using System.Net.WebClient to the Windows Temp directory. This pattern was observed in the DAEMON Tools supply chain attack to drop secondary payloads.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail). While this is a mitigation step, monitoring for it ensures compliance and tracks remediation efforts.
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Detects the execution of rundll32.exe attempting to load incorrectly spelled crypto DLLs from the AppData or Temp directories, specifically looking for "mcrypto.chiper" or "rypto.dll" in the command line, along with the export function "mcrypto_clean". This activity is associated with hands-on keyboard activity in the DAEMON Tools supply chain attack.
Detects Python command lines referencing a specific cryptographic string ('authencesn(hmac(sha256),cbc(aes))') known to be used in the exploitation of the 'Copy Fail' vulnerability (CVE-2026-31431). This string is highly specific and its presence in a Python command line is indicative of an attempt to exploit this particular CVE.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdate' that leverages PowerShell to download and execute a payload. This technique was observed in an Iranian-Nexus operation against Oman's government.
Page 89 of 119