Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads950 copies13 likes34,079 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for nmap used for internal network discovery.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Hunting rule for T1197 "Bitsadmin Download (cmd)". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1197 "Bitsadmin Download (cmd)". No public in-the-wild intel reference available; correlate before alerting.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Hunting rule for Linux procfs heap credential harvesting: resolve a target PID
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
(pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region
from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team
T1003.007 "Dump individual process memory with sh (Local)".
Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are
not debuggers or crash-analysis tooling.
Page 3 of 38