Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects a shell command referencing a hidden, octal/self-deleting payload
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
Detects awk-based shell command construction on ESX BusyBox that interleaves
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
Detects HTTP requests to known Sality (SALTY SPIDER) payload-hosting
domains distributed as "URL packs" to infected bots. Sality's P2P network tasks bots
with URL packs pointing to compromised or operator-maintained web servers hosting
malware payloads (such as the EggJagger clipjacker) disguised as innocuous image or
document files (.gif, .png, .pdf) on free hosting providers.
domains distributed as "URL packs" to infected bots. Sality's P2P network tasks bots
with URL packs pointing to compromised or operator-maintained web servers hosting
malware payloads (such as the EggJagger clipjacker) disguised as innocuous image or
document files (.gif, .png, .pdf) on free hosting providers.
Detects installation of a service or kernel driver named IPFILTERDRIVER,
the network packet-filtering driver used by the Sality P2P botnet (SALTY SPIDER) to
block infected hosts from reaching antivirus vendor domains/IPs and to shield the
peer-to-peer communication channel from local security tooling. Presence of this
service is a high-confidence indicator of Sality infection.
the network packet-filtering driver used by the Sality P2P botnet (SALTY SPIDER) to
block infected hosts from reaching antivirus vendor domains/IPs and to shield the
peer-to-peer communication channel from local security tooling. Presence of this
service is a high-confidence indicator of Sality infection.
Detects creation of a Windows service named "media_updaten" (the CoolClient backdoor persistence service, installed via CreateServiceA and started with 'sc start media_updaten') or "msagent" (the signed kernel-mode driver service that grants CoolClient its rootkit capabilities: process/file/registry hiding, object callback protection, and C2 IP filtering via Nsiproxy). Both exact service names are unique to this HoneyMyte campaign and are not associated with any legitimate Windows or third-party product.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Page 7 of 21