Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects mshta.exe executing remote or inline scripts, commonly abused for initial access in LOTL attacks
Detects outbound connections from network appliances to external IPs that may indicate command and control activity post-exploitation
Detects certutil.exe being used to download files from remote URLs, a common LOTL technique for payload delivery
Detects regsvr32.exe with scrobj.dll loading remote scriptlets to bypass application whitelisting
SharpSCCM Indicators
YARA-L
Detects the use of SharpSCCM, a post-exploitation tool designed to abuse Microsoft System Center Configuration Manager (SCCM)
for lateral movement and privilege escalation. Its execution may indicate adversarial attempts
to leverage enterprise management infrastructure for discovery, remote execution, or privilege escalation.
for lateral movement and privilege escalation. Its execution may indicate adversarial attempts
to leverage enterprise management infrastructure for discovery, remote execution, or privilege escalation.
Detects process execution patterns associated with the Sliver adversary emulation and red team framework. This rule identifies PowerShell-based UTF-8 console encoding manipulation patterns frequently observed in Sliver C2 stagers and implants, which adjust Console OutputEncoding to UTF8 prior to command execution. Such behavior may indicate unauthorized command-and-control (C2) activity or in-memory payload staging.
Detects creation of malicious Lua script files in AppData\Roaming\Adobe\Scripts directory used in infection chain.
Detects creation of malicious files in AppData\Roaming\Bluetooth directory used for DLL sideloading in infection chain.
Detects creation of malicious files in AppData\Roaming\ProShow directory used in infection chain.
Detects curl commands uploading files to temp.sh service for data exfiltration via update.exe.
Page 16 of 21