Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,074 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects phishing attempts where the sender's display name implies a sensitive role (e.g., Accounts Payable, Helpdesk, Vendor) while the authenticated header-From domain utilizes a 'support' subdomain. The rule triggers when the organizational root domain extracted from the email sender address does not match the branding present in the sender display name, indicating potential brand impersonation or business email compromise.
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
Detects Add-MpPreference invocations that add a Windows Defender exclusion for the TEMP folder, the C:\ root drive, or the .exe/.msi file extensions, a technique used to blind Defender ahead of malicious MSI/EXE installation.
Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.
Detects the deletion of the 'Zone.Identifier' alternate data stream from a downloaded .msi file, followed closely by the execution of that file using 'msiexec.exe'. This pattern is a known technique for bypassing Windows Mark-of-the-Web (MOTW) protections, which normally trigger SmartScreen warnings or Restricted View protections for internet-downloaded files.
Detects the deployment and execution of GSocket-based persistence mechanisms on Linux systems. This includes monitoring for the use of deployment scripts (gs_deploy.py, gs_persist.py), the establishment of cron jobs for periodic GSocket check-ins, the use of GSOCKET_HOST environment variables to control network behavior, and the execution of GSocket binaries staged in suspicious locations such as /tmp/.gs or web server directories.
Detects the creation of files named 'svchost.exe' within user Documents directories, excluding files located in 'C:\Windows\System32'. This rule identifies potential file masquerading, a tactic often used by adversaries to hide malicious binaries within legitimate system process names during post-exploitation activities.
Detects potential steganographic data extraction by monitoring for command-line usage of certutil.exe or findstr.exe associated with specific file size markers (304204 bytes) or URL patterns (stego-image.png?sid=) often used in browser-cached file extraction, specifically linked to DOUBLECUP Stage 1 activity.
Detects use of process-dumping utilities (procdump) or the rundll32 comsvcs.dll MiniDump technique invoked against chrome.exe, consistent with an unprivileged process reading browser process memory to extract the passkey Security Domain Secret (SDS) master key (Golden Pass-ta-key attack).
Page 9 of 119