Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects The Gentlemen ransomware execution. The ransomware requires a --password flag (8-byte key) and optionally --path for targeted encryption. Creates README-GENTLEMEN.txt ransom notes, appends .7mtzhh extension, and drops self-deleting batch files for cleanup.
Detects recovery inhibition commands used by The Gentlemen including Recycle Bin deletion, RDP log wiping, and Prefetch file removal to prevent forensic investigation and data recovery.
Detects NetExec SMB-based malware deployment across network ranges.
The Gentlemen use nxc smb with atexec/smbexec to disable Defender, mount shares
via net use, and execute ransomware (cerv.exe) across entire subnets. Also
detects creation of open shares with Everyone:FULL access.
The Gentlemen use nxc smb with atexec/smbexec to disable Defender, mount shares
via net use, and execute ransomware (cerv.exe) across entire subnets. Also
detects creation of open shares with Everyone:FULL access.
Detects significant file creation in 'C:\ProgramData\data\' used by The Gentlemen as a staging area for data consolidation before exfiltration via rclone or WinSCP SFTP connections.
Detects rclone execution with exfiltration patterns consistent with The Gentlemen operations. They use rclone copy with multi-threaded streams, bandwidth limits, and file type exclusions (exe, msi, mp3, avi, iso) for organized data theft via SFTP.
Detects Chisel tunnel creation used by The Gentlemen for encrypted
C2 communication. They create reverse SOCKS proxies on port 443 with very low
AV detection rate, maintaining persistent internal network access.
C2 communication. They create reverse SOCKS proxies on port 443 with very low
AV detection rate, maintaining persistent internal network access.
Detects multiple failed FortiGate VPN login attempts using known default usernames, consistent with The Gentlemen brute force campaigns. They maintain ~969 validated brute-forced FortiGate VPN credentials and test anti-honeypot probe passwords with Russian garbage strings.
Detects execution of Impacket dpapi.py with backupkeys parameter,
used by The Gentlemen to extract DPAPI backup keys from domain controllers
for decrypting stored credentials across the domain.
used by The Gentlemen to extract DPAPI backup keys from domain controllers
for decrypting stored credentials across the domain.
Detects execution of ChromeKB3.exe, a custom tool developed by
The Gentlemen for extracting saved passwords from Google Chrome via AppBound
injection (SHA256: 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b).
The Gentlemen for extracting saved passwords from Google Chrome via AppBound
injection (SHA256: 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b).
Detects execution of The Gentlemen custom EDR killer tools
All.exe and Allpatch2.exe that exploit vulnerable drivers to terminate
endpoint security processes at kernel level.
All.exe and Allpatch2.exe that exploit vulnerable drivers to terminate
endpoint security processes at kernel level.
Page 13 of 21