Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects loading of offreg.dll (Microsoft offline registry library)
by non-standard processes. BlueHammer uses offreg.dll to parse the SAM, SYSTEM, and SECURITY hives extracted from a VSS snapshot, recovering the boot key and decrypting NTLM hashes without touching the locked live registry.
by non-standard processes. BlueHammer uses offreg.dll to parse the SAM, SYSTEM, and SECURITY hives extracted from a VSS snapshot, recovering the boot key and decrypting NTLM hashes without touching the locked live registry.
Detects potential DLL sideloading attack where msimg32.dll is loaded from non-system directories, a technique used by Qilin ransomware
Detects FoxitPDFReader.exe spawning suspicious child processes which may indicate DLL sideloading exploitation used by Qilin ransomware
Detects potential Event Tracing for Windows tampering through suspicious access to ntdll.dll memory regions, a technique used by Qilin ransomware to suppress telemetry
Detects network communication to IP addresses associated with BRICKSTORM malware operations targeting vSphere environments. These IPs have been observed in active campaigns compromising VMware vCenter and ESXi infrastructure.
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects mass service termination targeting backup, database, and virtualization services. The Gentlemen stop Veeam, SQL, Oracle, SAP, Acronis, BackupExec, PostgreSQL, Docker, and VMware services before encryption.
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects execution of BRICKSTORM malware components including BRICKSTEAL credential harvester, pg_update, vmp utilities, and SLAYSTYLE tools used in vSphere infrastructure attacks.
Page 12 of 21