Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers311 downloads7,465 copies113 likes78,089 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects the presence of the unique 'ic-tracker-js' ID within script tags on web server files (.php, .html, .js), which is a high-fidelity indicator of a compromised WordPress site by the IClickFix framework. This rule looks for file creation or modification events where the initiating process command line contains the malicious string.
Detects the use of the living-off-the-land binary (LOLBIN) extrac32.exe to decompress cabinet (.cab) or .vstm files from user-writable locations. This technique is used by loaders like CastleLoader to unpack malicious stages.
Detects potential JSON Web Token (JWT) algorithm confusion attacks. This occurs when an attacker sends a token signed with a symmetric algorithm (e.g., HS256) to a server expecting an asymmetric one (e.g., RS256). If the server is misconfigured, it may use its public key as the HMAC secret, allowing the attacker to forge valid tokens. The rule specifically looks for JWTs with symmetric HMAC-based algorithms (HS256, HS384, HS512) being sent to applications configured to exclusively use asymmetric key algorithms.
Detects when the Windows Service Control Manager (services.exe) spawns a suspicious child process. This can indicate an attacker has configured a service's recovery options to execute a malicious command or script upon service failure.
Detects network connections to domains and URLs known to be used by the 'Contagious Interview' campaign for staging malicious batch scripts and PyArmor payloads. This rule specifically looks for connections to hardcoded malicious domains and URL paths identified with the campaign.
Detects modifications to the registry values responsible for service recovery actions, specifically the 'FailureCommand' or 'FailureActions' values. This can indicate an attacker is configuring a service to execute a malicious payload upon failure for persistence or privilege escalation.
Detects the use of the GNU Debugger (GDB) to dump memory from a live process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets directly from memory, bypassing file-based security controls.
Detects network connections to known Command and Control (C2) infrastructure associated with the APT37 Ruby Jumper campaign. This includes the C2 IP address for the FOOTWINE backdoor and the Zoho WorkDrive Client ID used by the RESTLEAF implant for exfiltration.
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
Detects the execution of legitimate Windows binaries with command-line arguments containing URL patterns. This is a technique used by the Dohdoor malware campaign to pass C2 information to a sideloaded malicious DLL.
Page 98 of 119