Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers458 downloads641 copies43 likes15,532 views
206 detections
Filters
Last updated
All Time
Detection languages
192
14
Categories
54
44
14
12
12
Platforms
71
31
6
5
3
Products / Services
12
9
8
4
4
MITRE Techniques
46
40
37
36
20
CVEs
3
3
2
2
1
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
Detects creation of a hidden scheduled task disguised as a legitimate software update, a persistence technique used by ACR Stealer's Campaign 1 installer stage. The malware extracts payloads into deceptive AppData directories such as LogiOptionsPlus and registers a scheduled task to relaunch a pythonw.exe-based Python loader at user sign-in.
Detects regsvr32 executing cloud.dll (or a similarly named DLL exporting DllRegisterServer) as observed in the MuddyWater-linked PatchAgent loader chain. Stage 1 is executed via 'regsvr32 /s cloud.dll' following ClickFix-style social engineering, invoking DllRegisterServer with no user interaction to begin the three-stage loader chain leading to a hollowed notepad.exe HTTP backdoor.
Detects the PatchAgent Stage 3 HTTP C2 protocol recovered from the decrypted shellcode: plain HTTP requests to /api/checkin, /api/cmd/<id>, or /api/result/<id> combined with the hardcoded, truncated User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" (a real browser UA continues past this). Matching the API path plus the exact short UA keeps this durable across C2 IP rotation (observed on 46.30.188[.]99 and 185.228.83[.]217, port 8443).
Detects Python reverse shell execution from /tmp/rev_shell.py
as described in Siemens ROX II exploitation chain. This specific file path
and Python command injection pattern indicates active exploitation of the
command injection vulnerabilities in the feature key validation function.
as described in Siemens ROX II exploitation chain. This specific file path
and Python command injection pattern indicates active exploitation of the
command injection vulnerabilities in the feature key validation function.
Detects connections to domains associated with the Montana Empire phishing kit, which leverages AI-hallucinated postal service domains for credential harvesting. This kit targets phantom domains identified through LLM hallucination prediction and exploits AI-generated domain suggestions.
Detects connections to AI-hallucinated API endpoints commonly generated by coding assistants. These phantom domains are weaponized by adversaries to intercept CI/CD pipeline telemetry, build notifications, and developer authentication tokens from automated systems.
Detects network connections to Telegram bot API endpoints consistent with the Montana Empire phishing kit's credential exfiltration mechanism. This kit uses Telegram as a C2 channel for real-time data theft from phantom squatting domains that exploit AI-hallucinated URLs.
Detects network communication to OpenClaw malicious infrastructure. OpenClaw operates a skill marketplace that distributes AI-generated malware and exploits, representing an emerging supply chain threat to organizations.
Detects file creation or process launch of a MeshCentral
remote-management agent that has been renamed to impersonate an Azure
service, or whose hash matches a known sample, as used by the ShinyHunters
threat actor for persistent remote access during the Oracle PeopleSoft
exploitation campaign reported by Mandiant in June 2026.
remote-management agent that has been renamed to impersonate an Azure
service, or whose hash matches a known sample, as used by the ShinyHunters
threat actor for persistent remote access during the Oracle PeopleSoft
exploitation campaign reported by Mandiant in June 2026.
Page 9 of 21