Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects cURL command used by UNC3753 to download SuperOps RMM agent during social engineering attacks. The threat actor instructs victims to execute this specific command pattern to install persistent remote access tools for data theft operations.
Detects exploitation attempts of CVE-2026-9384, a critical command injection vulnerability in Totolink A8000RU routers. Attackers target the 'setDiagnosisCfg' function in '/cgi-bin/cstecgi.cgi' by injecting OS commands into the 'ip' parameter.
Detects exploitation attempts of a Path Traversal vulnerability (CWE-22) in UniFi OS devices. Attackers use directory traversal sequences to access sensitive system files like /etc/passwd or shadow files to gain unauthorized account access.
Detektiert Gremlin Stealer TTPs wie Crypto-Clipping oder Session-Hijacking durch Analyse von verdächtigen Prozessbefehlen und Ressourcen-Manipulation laut Unit 42 Bericht.
Detects exploitation attempts of CVE-2026-48172 in the LiteSpeed User-End cPanel Plugin. Attackers abuse the redisAble function to escalate privileges, potentially to root, by mishandling Redis enable/disable features.
Detects emails with PDF attachments containing code of conduct
themed content as observed in multi-stage phishing campaigns. These PDFs contain
malicious links that redirect users through CAPTCHA and staging pages to credential
harvesting sites with AiTM token compromise capabilities.
themed content as observed in multi-stage phishing campaigns. These PDFs contain
malicious links that redirect users through CAPTCHA and staging pages to credential
harvesting sites with AiTM token compromise capabilities.
Detects HTTP requests to CAPTCHA and intermediate staging pages used in code of conduct phishing campaigns. These pages filter out automated defenses and reinforce legitimacy before redirecting to AiTM authentication flows.
Detects common LOLBins spawned by Microsoft Office applications, indicating potential macro-based initial access leading to execution
Detects exploitation attempts targeting CVE-2023-33538 vulnerability in TP-Link routers. Identifies HTTP GET requests to the /userRpm/WlanNetworkRpm endpoint with command injection payloads attempting to download and execute Mirai-like botnet malware.
Detects non-Defender processes accessing mpasbase.vdm signature definition files. The BlueHammer exploit acquires a batch oplock on this file to freeze Defender mid-read, then swaps the underlying junction target to redirect SYSTEM-context reads to the SAM hive in a VSS snapshot.
Non-Defender access to VDM files has zero legitimate use cases.
Non-Defender access to VDM files has zero legitimate use cases.
Page 11 of 21