Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
Detects the process st.exe (identified as StealC / TrojanPSW:Win32/StealC) executing and subsequently accessing well-known browser credential store artifacts (Login Data, Cookies, key4.db, logins.json, Local State, Web Data) used to harvest stored passwords and session data from browsers.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects autoit3.exe invoking process injection Windows APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle) from kernel32.dll targeting the legitimate charmap.exe process, consistent with the AutoIT payload injector chain delivering VIPKeylogger/MedusaHVNC.
Detects Active Directory replication requests (DsGetNcChanges) performed by accounts not identified as Domain Controllers. This behavior is indicative of a DCSync attack, where an adversary uses the directory replication API to extract credentials from Active Directory, potentially leveraging exploited computer accounts.
This rule detects the creation or modification of systemd override configuration files, specifically looking for files named 'override.conf' or 'gtwk_module.conf' within directories under '/etc/systemd/system/'. The logic is specifically tuned to identify persistence mechanisms targeting the systemd service manager, including activity associated with the 'rsyslog.service.d' path, which is indicative of the gtwk_module agent attempting to persist across system reboots.
Page 11 of 119