Aaron etr
@sertg0 followers47 downloads24 copies1 like172 views
21 detections
Filters
Last updated
All Time
Detection languages
15
3
2
1
Categories
14
7
4
3
3
Platforms
19
2
1
Products / Services
4
3
3
2
2
MITRE Techniques
9
5
5
5
4
CVEs
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects execution of the Mimikatz tool where the 'sekurlsa' module is specified in the command line. This module is commonly used to extract sensitive credential material, such as cleartext passwords and Kerberos tickets, from the LSASS process memory.
This rule detects the presence of the GodDamn ransomware encryptor on a host by identifying the specific binary filename (encrypter-windows-gui-x86.exe), its known SHA256 hash, or the presence of the .God8Damn file extension commonly associated with files encrypted by this malware.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.
Detects a malicious binary masquerading as a Symantec executable (symantec.exe) staged in the user's Music directory. The rule triggers on a known file hash or the combination of the specific filename and file path, indicative of a dropper attempting to install the PoisonX kernel driver.
Detects the execution of psexesvc.exe, the service component of the PsExec tool, spawned from services.exe. This activity is indicative of lateral movement through the use of PsExec, which installs and executes the service to run commands remotely.
Detects outbound network traffic from internal hosts to known IP addresses associated with AnyDesk relay infrastructure, which may indicate unauthorized use of remote access tools.
Detects the creation or starting of an AnyDesk service using command-line arguments to specify custom configuration directories or service names. This pattern is often used by adversaries to establish persistence or ensure remote access tools are configured with specific, potentially silent or pre-defined, settings.
Page 1 of 3