Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,089 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This detection identifies the consent or addition of an OAuth application that may be impersonating a legitimate, well-known brand. The logic flags applications whose names mimic major brands (e.g., Adobe, Microsoft, DocuSign) and use a reply URL hosted on a shared or free platform, a common tactic in consent phishing campaigns.
Detects the use of 'netsh.exe' to create firewall rules with names specific to the Prometei botnet. Prometei creates rules to allow its own C2 traffic ("Secure Socket Tunneling Protocol (HTTP)") and to block other potential attackers ("Banned brute IPs") as part of its system hardening.
Detects instances of specific legitimate binaries loading known malicious proxy DLLs. This pattern targets the exact sideloading pairs identified in a campaign leveraging a modified Havoc C2 agent.
Detects the execution of the Lua interpreter with a script that has a .ini extension or the known malicious name 'alien.ini' from the Notepad++ supply chain attack. This TTP was used to load and execute shellcode via the Lua Alien FFI library.
Detects the creation of a Windows kernel service using sc.exe where the binary path points to common user-writable or temporary directories. This is a common TTP for Bring Your Own Vulnerable Driver (BYOVD) attacks, often used for privilege escalation and persistence.
Identifies consent grants to OAuth applications with Application IDs matching known malicious campaigns. The IOCs are sourced from Wiz Research on campaigns from 2019-2025 involving brand impersonation and consent phishing.
Detects the loading of 'version.dll' by 'filezilla.exe' from a non-system directory. This behavior is a strong indicator of a DLL Sideloading attack used by a trojanized FileZilla variant. Legitimate FileZilla distributions do not ship with this DLL.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
This detection identifies instances where a user grants consent to an OAuth application that has very low prevalence within the tenant and requests high-risk permissions. This pattern is a strong indicator of a targeted consent phishing attack, as malicious apps often target a small number of users to gain initial access.
Page 94 of 119