Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects Node.js processes performing clipboard monitoring or screenshot capture using npm packages like screenshot-desktop, consistent with Contagious Interview spyware.
Detects curl or wget commands fetching scripts from vercel.app or URL shorteners and piping to shell execution, consistent with Contagious Interview initial access.
Detects execution of Velociraptor which may indicate threat actor using legitimate EDR tool for malicious C2
Detects Visual Studio Code or Cursor spawning shell processes, indicating potential exploitation of repository task configurations for malicious execution.
Detects execution of Warcode Crystal-based shellcode loader from common writable public directories used by APT36
Detects file modification patterns consistent with Interlock ransomware including characteristic file extensions and ransom note creation.
Detects Node.js processes performing credential enumeration with patterns matching OtterCookie backdoor behavior targeting wallets, passwords, and keys.
Detects network connections to Google Sheets API endpoints indicative of Living Off Trusted Services C2 technique
Detects network connections to Cloudflare tunnel domains associated with Hive0163 threat actor command and control infrastructure.
Detects Python processes accessing paths associated with Invisible Ferret backdoor deployment including .n2/pay, .npl, and .n2/bow directories.
Page 15 of 21