Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects instances where the Argo CD repo-server or kustomize processes spawn unexpected child processes, such as shells or network utilities. This behavior is indicative of potential command injection, specifically concerning the unauthenticated GenerateManifest gRPC service vulnerability (CVE-2024-31989), where an attacker could execute arbitrary code on the underlying host or container.
Detects the execution of PowerShell with security-bypassing flags (-ExecutionPolicy Bypass, -NoProfile, -WindowStyle Hidden) launched by the Windows Script Host (wscript.exe). This pattern is associated with the VEIL#DROP campaign where JavaScript lures invoke PowerShell to bypass AMSI and security controls.
Detects TeamPCP-associated behavior in CI/CD environments, specifically the encryption and staging of sensitive secrets using tools like OpenSSL, tar, and curl. The rule monitors for the execution of at least three distinct tools from a specified list within a short time window that interact with files in a /tmp/tmp. staging directory, indicative of preparation for data exfiltration.
Detects suspicious process execution by GitHub Runner.Worker or Runner.Listener on CI runners. It specifically targets the execution of scripts or binaries associated with compromised action components (such as trivy-action or setup-trivy) where version tags have been tampered with to inject credential-harvesting code. The rule monitors for unauthorized command line arguments or file paths linked to these components.
This rule detects command-line arguments and file names associated with the execution of Mimikatz or derived tools (such as SafetyKatz). It monitors for specific modules and flags, including credential harvesting (sekurlsa, lsadump, vault), DPAPI operations, and Kerberos manipulation, which are characteristic of adversary credential theft and privilege escalation activities.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects suspicious execution patterns on CI/CD runners involving the decoding of base64-encoded payloads piped into sudo python3, which is often used for credential harvesting. The rule identifies this behavior through two methods: sibling process correlation where 'base64 -d' and 'sudo python3' occur within 60 seconds of each other, and the observation of interpreters (sh, bash, python, etc.) launched without arguments in conjunction with runner-specific process patterns, indicative of stdin-piped execution.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects the execution of Node.js where the command line arguments reference a .woff2 font file. This behavior is indicative of an adversary attempting to execute a malicious payload disguised as a legitimate font file, a technique previously associated with the PolinRider campaign.
Detects the presence of file system artifacts associated with the malicious Chromium extension 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd) on an endpoint. This extension is known to perform search hijacking and keystroke exfiltration.
Page 28 of 119