Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects file creation or process execution events where the observed SHA256 matches known EchoGather backdoor or associated XLL loader samples linked to the Paper Werewolf (GOFFEE) threat group. This is a high-confidence IOC-based detection. Use it for rapid triage and scoping; follow up with behavioral detections for durable coverage.
Detects an anomalously high rate of network connections to a MongoDB server from a single source IP, a pattern associated with the exploitation of MongoBleed (CVE-2025-14847).
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
Detects obfuscated PowerShell commands used to disable security features, such as AMSI bypass, disabling TLS certificate validation, and enabling Restricted Admin mode. This behavior is a known TTP of the Qilin ransomware group.
Detects MongoDB instances with a vulnerable configuration where 'zlib' is enabled for network message compression. This configuration makes the server vulnerable to MongoBleed (CVE-2025-14847).
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
Detects events involving indicators of compromise (IOCs) that are associated with currently active APT groups
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
Detects the execution of scripts (.ps1, .vbs, .php) with randomized or suspicious names from the Temp directory, where the parent process is explorer.exe, wscript.exe, or cscript.exe. This behavior is indicative of a dropper staging and executing its payload.
Page 18 of 21