Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects creation of a Registry Run key value named 'Realtek HD Audio' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a GoGRPC payload staged as %APPDATA%\sekv*.exe, used for persistence after a Quick Assist vishing intrusion.
Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
This rule detects potential ransomware activity by correlating the execution of 'gpscript.exe', which is used to process Group Policy Object (GPO) logon scripts, with subsequent mass file encryption events involving files with the '.SINOBI' extension on the same host within a one-hour window. The rule specifically flags instances where at least five files are encrypted, indicating a high likelihood of a domain-wide ransomware deployment delivered via malicious GPO modification.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
Detects the execution of insmod or modprobe commands used to manually insert a Linux kernel module (LKM). This behavior is commonly associated with kernel-mode rootkit installation, where adversaries attempt to gain persistence or hide malicious activity from standard system enumeration utilities.
This rule detects persistence mechanisms associated with the CornFlake RAT by identifying three specific activities: the creation of Windows Registry Run or RunOnce keys referencing 'svchost32', the creation of scheduled tasks using 'schtasks.exe' that involve 'svchost32', and a watchdog process pattern where a 'svchost32' process is launched by a parent process that is also identified as 'svchost32'.
Detects email-delivered URLs and network connections to phishing lure infrastructure masquerading as AWS console or Apple ID/iCloud sign-in pages used to funnel victims into the DarkSword iOS exploit chain.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Page 14 of 119