Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects suspicious command-line arguments used with Windows utilities (LOLBAS)
Detects PowerShell being copied and renamed to 'wt.exe' in the ProgramData directory, initiated by cmd.exe, powershell.exe, or pwsh.exe, and executing a command line containing '-curl'. This behavior has been documented in the Axios npm supply chain attack.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
Detects the execution of scriptlet files or the use of scrobj.dll (squiblydoo)via command line, particularly when initiated by common scripting or command interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
Detects scripts modifying Windows registry run keys for establishing persistence
Detects the use of PowerShell to disable various aspects of Microsoft Defender. This technique is commonly used by malware to evade detection before executing malicious payloads.
Detects supply chain compromise activity targeting telecommunications infrastructure
This rule detects the use of common utilities to transfer executable files (shell scripts, python scripts, perl scripts, or ELF binaries) between systems.
Detects information stealer malware with encrypted configuration parsing
Detects information stealer malware with encrypted configuration parsing
Page 25 of 38