Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects a malicious teardown sequence involving the 'drvsvc' service being stopped or deleted in the registry, followed by the deletion of the 'C:\Windows\System32\drivers\drv.sys' file within a 15-minute window. This behavior is indicative of a driver redeployment process, often associated with the removal of security-disabling components.
Detects GitHub issue/PR comments attributed to the adk-bot service account that contain privileged workflow-trigger strings ('@gemini-cli' or '/adk-issue-fix'). The CI authorization gate validates only the commenter's account identity, not whether the trusted bot account was manipulated via prompt injection into posting the trigger itself, so any adk-bot comment containing these strings is a candidate forged bridge into maintainer-only automation.
Detects the AutoIT payload injector multi-stage execution chain (wscript.exe -> powershell.exe -> cmd.exe -> powershell.exe -> autoit3.exe -> charmap.exe) used to deliver VIPKeylogger and MedusaHVNC, culminating in process injection into the legitimate charmap.exe utility.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects local processes invoking the splice() syscall with the MSG_SPLICE_PAGES flag to map file descriptors of readable SUID-root binaries directly into network socket buffers. This is the core technique behind CVE-2026-31635 (DirtyDecrypt), which corrupts the page cache of SUID-root binaries by placing their pages into attacker-controlled network packets before authentication completes.
Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.
Page 13 of 119