Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects execution of a bash reverse shell using /dev/tcp TCP redirection, a persistence/backdoor technique used by TA458 SpyPress operators on compromised webmail servers to connect back to C2 infrastructure.
Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).
Detects the execution of Chrome or Edge browsers with --headless and --remote-debugging-port command-line flags when launched by suspicious or non-standard parent processes. This behavior is commonly associated with msaRAT, which leverages the Chrome DevTools Protocol (CDP) to establish a covert Command and Control (C2) channel through a headless browser instance.
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
Detects a suspicious pattern where a process creates a file in /dev/shm/, unlinks it, and re-executes itself from /proc/self/fd/ while manipulating the process name to masquerade as the systemd-journald daemon. This behavior is indicative of fileless execution techniques used by malware to maintain a presence while blending in with legitimate system processes.
Detects the NightLedger DLL search-order hijacking technique where a malicious SspiCli.dll is loaded by the legitimate process AppVShNotify.exe. This rule triggers when SspiCli.dll is loaded from a directory other than the standard Windows System32 or SysWOW64 directories.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
Detects specific DLLs associated with the BridgeHead tunneler (a tool attributed to the threat group Mirage Kitten) loading advapi32.dll. This dynamic loading behavior is consistent with the malware attempting to resolve and call the GetUserNameA function to verify the execution environment username, a technique commonly used to detect and evade automated sandbox analysis.
Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.
Page 15 of 119