Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,090 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the execution of PowerShell that has been renamed to 'wt.exe', matching the Axios RAT Windows payload behavior. This rule identifies processes masquerading as Windows Terminal (wt.exe) but whose underlying executable is actually PowerShell.
Detects command-line registry modifications that enable 'EveryoneIncludesAnonymous' or disable 'RestrictAnonymous' in the Local Security Authority (LSA) configuration. Attackers may perform these actions to lower the environment's security posture, explicitly allowing anonymous LSA enumeration, which aids in internal network discovery.
Detects the execution of bcdedit.exe to disable the Windows Recovery Environment or ignore boot failures. This is a common pre-encryption technique used by Kyber ransomware to prevent defenders from restoring the OS.
Detects the use of esxcfg-advcfg to alter the BufferCache settings on an ESXi host. This activity can be a precursor to bulk file encryption, as seen with the 'Gentlemen Linux variant' which modifies VMFS write buffer and flush interval to prepare ESXi hosts for fast, reliable encryption.
Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.
This rule detects file creation, modification, or renaming events related to 'TieringEngineService.exe' in the 'C:\Windows\system32\' directory, or process execution of 'TieringEngineService.exe' running as the 'SYSTEM' account. This activity could indicate suspicious system-level operations or potential abuse of a legitimate Windows component.
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Detects potential NetScaler administrative session hijacking by monitoring for the usage of SESSID or NITRO_SK administrative cookies from multiple source IPs. Attackers leverage CVE-2026-3055 to steal these specific session cookies to gain unauthorized administrative access.
Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
Page 91 of 119