Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,091 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.
Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Detects legitimate executables, known to be abused in the Notepad++ supply chain attack, running from user AppData directories. This behavior is highly indicative of DLL side-loading.
Detects the use of PowerShell to disable or weaken Microsoft Defender security features. This technique is commonly used by malware to evade detection before executing malicious payloads, as seen in the referenced Fortinet report.
Detects common late-stage ransomware indicators including the deletion of Volume Shadow Copies or the clearing of Windows Event Logs using vssadmin.exe or wevtutil.exe. These are reliable signals of imminent impact.
Detects network traffic matching patterns used by the Chrysalis backdoor for C2 communications. The malware was observed using the domain 'api.skycloudcenter.com' and mimicking DeepSeek AI API URL paths to evade detection.
Detects the command-line pattern of reassembling a ZIP or CAB file from fragmented parts using the 'copy' command. This technique was observed in a campaign where adversaries manually reconstructed payloads on disk to evade detection by splitting them into multiple parts and then reassembling them.
Detects the FileZilla executable (filezilla.exe) spawning the C# compiler (csc.exe). This behavior is highly anomalous for a standard FTP client and is a technique used by a trojanized FileZilla variant to perform runtime .NET compilation for its payload.
Detects the creation or modification of specific registry values (UXMP, UFID, UCID) in known Havoc C2 fallback registry paths (e.g., \SOFTWARE\Classes\Local Settings\Software\Microsoft\ and \SOFTWARE\Microsoft\SQMClient\) used by a modified Havoc Demon agent for C2 fallback and configuration.
Page 93 of 119