Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects creation of scheduled task for rclone-based data
exfiltration. The Gentlemen create a task named SafeSync that runs 'rclone.ps1' at startup with SYSTEM privileges and HIGHEST run level.
exfiltration. The Gentlemen create a task named SafeSync that runs 'rclone.ps1' at startup with SYSTEM privileges and HIGHEST run level.
Detects silent AnyDesk deployment with password setting, used
by The Gentlemen for persistent remote access. They use --install combined
with --start-with-win --silent and --set-password, deployed via NetExec
or Conti-style PowerShell functions with hardcoded credentials.
by The Gentlemen for persistent remote access. They use --install combined
with --start-with-win --silent and --set-password, deployed via NetExec
or Conti-style PowerShell functions with hardcoded credentials.
Detects loading of vulnerable signed drivers used by The Gentlemen
for BYOVD-based EDR/AV termination at kernel level. Known drivers include
ThrottleBlood.sys (renamed ThrottleStop.sys) and viragt64.sys.
for BYOVD-based EDR/AV termination at kernel level. Known drivers include
ThrottleBlood.sys (renamed ThrottleStop.sys) and viragt64.sys.
Detects installation of Windows PowerShell Web Access (PSWA)
feature, used by The Gentlemen for persistent web-based PowerShell access.
They add wildcard authorization rules allowing all users on all computers.
feature, used by The Gentlemen for persistent web-based PowerShell access.
They add wildcard authorization rules allowing all users on all computers.
Detects creation of or addition to the ESX Admins Active
Directory group, used by The Gentlemen to exploit CVE-2024-37085 for
ESXi host takeover with full administrative access.
Directory group, used by The Gentlemen to exploit CVE-2024-37085 for
ESXi host takeover with full administrative access.
Detects PowerShell reflective assembly loading with byte array reversal technique used by APT36 SheetCreep
Detects network communication to known APT36 Havoc C2 infrastructure IP addresses
Detects scheduled task creation with naming patterns matching APT36 CreepDropper persistence mechanism
Detects silent installation of Cloudflare tunnel client which may establish covert C2 channels
Detects outbound network connections to AWS Lambda function URLs which may indicate HazyBeacon backdoor or similar cloud-based C2
Page 14 of 21