Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,863 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
This rule detects the creation of a new WordPress administrator account within a short window (15 minutes) of an anomalous authentication or registration event on the same account or session. It is designed to identify post-exploitation activity, specifically persistence mechanisms following the exploitation of web application vulnerabilities like arbitrary file uploads or authentication bypasses in WordPress plugins.
Detects the spawning of cmd.exe by processes associated with Microsoft Exchange Server, specifically MSExchangeMailboxReplication.exe or w3wp.exe. This activity is indicative of post-exploitation command execution following an exploit of an Exchange web service or MRSProxy endpoint.
Detects the creation of .php files within the wp-content/uploads directory tree by common web server or PHP-FPM processes. This behavior is indicative of an adversary attempting to drop a web shell via file upload bypass vulnerabilities, such as those exploiting MIME-type manipulation.
Detects the use of curl.exe or curl to communicate with the malicious domain 'i.apee.my.id', initiated by a VS Code integrated terminal process. This behavior is indicative of malicious VS Code extensions exfiltrating data via a hidden terminal session.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
Detects unauthenticated WordPress administrator account takeover attempts targeting the User Profile Builder plugin. The rule identifies inbound HTTP GET requests containing the 'autologin=true' parameter and a forged '_wpnonce' value matching the 'autologin-1-' pattern, which exploits an authentication bypass vulnerability (CVE-2026-15826) to gain unauthorized session access as user ID 1.
This rule detects malicious activity associated with the RtkNGUI64.exe backdoor, which masquerades as a legitimate Realtek Audio process. It identifies when this process spawns cmd.exe for command execution or interacts with 'tempcache.tmp' files, indicating potential C2 tasking and persistence via WMI event consumers.
Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.
Page 3 of 119