Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
This detection rule identifies logins originating from suspicious remote systems commonly associated with penetration testing or malicious activity. These systems may include Kali Linux, Parrot OS, BlackArch, or other offensive security distributions. Such platforms are often used for reconnaissance, exploitation, credential harvesting, or lateral movement. The rule leverages indicators like unusual hostnames, known IP ranges, remote access patterns, or user agent strings to detect potentially unauthorized or anomalous access from these environments.
Detects ransom note creation associated with Yurei ransomware.
Detects PowerShell execution launched by a batch script located in a user's Startup folder, where the PowerShell command line contains common download primitives. This pattern aligns with persistence via Startup folder (BAT) combined with retrieval of a next-stage payload, as reported for Paper Werewolf (GOFFEE) activity.
Detects APT28's NotDoor backdoor deployment using DLL sideloading technique via legitimate signed OneDrive.exe. Loads malicious SSPICLI.dll to disable Outlook macro security and install VBA backdoor targeting NATO organizations.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
Detects APT28's NotDoor backdoor registry modifications to establish persistence and disable Outlook macro security. Modifies LoadMacroProviderOnBoot, Level, and General registry keys to enable silent macro execution.
Page 19 of 21