Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects creation of a JSP/JSPX/WAR server-side script inside
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
an AhsayCBS installation or web application directory. In this campaign the
actors exploited critical AhsayCBS vulnerabilities and dropped webshells into
the application web directories to maintain persistent remote access. Legitimate
deployment writes scripts from the AhsayCBS updater, not ad-hoc into web roots.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects an agentic AI application (e.g., Claude Code, ChatGPT Codex) directly
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Detects repeated OAuth device authorization ('device code') grant flow authentication events targeting the same user within a short window, which is indicative of an active device code phishing attempt.
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\\ root (e.g. C:\\{GUID}\\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\\Users\\ or C:\\Windows\\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects msiexec.exe executing an MSI package named update_ms.msi
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
staged in ProgramData. Chaos ransomware disguises this installer's properties
and filename to impersonate a legitimate Windows Update package. On execution,
a custom action (CA_Run_EA2AEBC3) loads an embedded DLL (Bin_lib_EA2AEBC3,
lib.dll) directly into memory, deploying the msaRAT payload. This rule sees
the installer execution only; the in-memory module load is not observed here
and would need a separate PROCESS_MODULE_LOAD rule.
Detects curl.exe writing an MSI package into the ProgramData
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
Detects cmd.exe spawned by a python.exe or pip.exe process with a command line invoking netstat or calc.exe. Matches the payload behavior described for the malicious redpy_demo PyPI package, whose __main__.py used Python's subprocess module to execute these commands via cmd.exe automatically at module invocation, without any direct victim interaction with the payload.
Page 5 of 21