Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Detects Outlook Safe Links redirector URLs that decode to a destination path ending in /js, consistent with a credential-harvesting landing page hosted on a compromised or bystander third-party domain behind the CTA link.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects malicious PowerShell activity attempting to bypass the Antimalware Scan Interface (AMSI) by identifying command-line patterns associated with 'CountLoader' and similar malware. It targets the use of .NET reflection to manipulate AmsiUtils fields and the use of dynamic function resolution (D/Invoke) techniques via GetDelegateForFunctionPointer and GetProcAddress to evade static detection.
Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.
This rule detects potential ransomware activity by monitoring for a high volume (exceeding 20 occurrences within a 5-minute window) of file rename, modification, or creation events associated with the '.sinobi' file extension. The logic aggregates these events by device and account to identify patterns consistent with mass file encryption, mapping to the MITRE ATT&CK T1486 (Data Encrypted for Impact) technique.
Detects malicious Android applications that leverage Accessibility Services for automated interaction. Specifically, the rule monitors for the installation of an app, followed by the immediate enabling of Accessibility Services and subsequent synthetic tap events on the screen within a narrow timeframe. This pattern is characteristic of malware attempting to automatically grant itself sensitive permissions or bypass user consent dialogs, such as the behavior observed in the BTMOB RAT.
Detects User Account Control (UAC) bypass techniques associated with ChocoShell. The rule monitors for specific malicious patterns: the execution of 'schtasks.exe' to trigger the 'SilentCleanup' task, the spawning of unexpected child processes from 'wsreset.exe' or 'sdclt.exe', and the invocation of 'sdclt.exe' with the '/KickOffElev' argument. These behaviors are indicative of an attacker attempting to elevate privileges by abusing Windows auto-elevating binaries.
Detects an editor/extension-host process (not git.exe) reading multiple internal Git repository files (.git/config, .git/HEAD, .gitconfig) within a short window, matching malicious extensions parsing repo remote URLs, branch/commit info, and commit email domains without invoking the git binary.
Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.
Page 12 of 119