Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects APT28's NotDoor VBA backdoor in Microsoft Outlook monitoring emails for trigger words like 'Daily Report'. Uses obfuscated VBA code with Application_MAPILogonComplete and Application_NewMailEx events for persistence and email-based C2.
Detects creation of SesameOp marker and exception files used by the OpenAIAgent.Netapi64 implant. Observable files include marker 'Netapi64.start' and exception logs 'Netapi64.Exception' created under 'C:\Windows\Temp\'; creation of either file is a high-fidelity indicator of SesameOp loader activity.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects PowerShell reconnaissance commands associated with SocGholish/RomCom activity, where PowerShell is invoked with embedded double quotes to evade simple detections.
Detects network traffic consistent with RomCom's Mythic C2 framework. This includes connections to known C2 domains or requests for specific URI paths that return a 403 Forbidden status with an Nginx server header, a known fingerprint of this infrastructure.
Detects the creation or modification of scheduled tasks that execute Python scripts or masquerade as legitimate system processes. This behavior is used by threat actors in the 'Contagious Interview' campaign to establish persistence.
Detects network connections to Pastebin.com from a Python process. This behavior is associated with the InvisibleFerret malware, as part of the 'Contagious Interview' campaign, which retrieves additional payloads from Pastebin.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
Page 20 of 21