Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects instances where the Claude Code AI agent or its subprocesses are used to establish persistence. This is achieved by monitoring for crontab modifications or direct writes to SSH authorized_keys files, which are common indicators of post-exploitation activity following an Axiom-style indirect prompt injection.
Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
This rule detects unauthorized access attempts to common cryptocurrency wallet data files and Telegram Desktop session information, a pattern of behavior consistent with the data collection phase of the Vidar information stealer.
Detects the execution of scripting interpreters and remote management tools originating from the SimpleHelp RMM process tree. This activity is indicative of post-exploitation abuse where an attacker, having hijacked a technician session (e.g., via CVE-2026-48558 OIDC bypass), uses the RMM console to execute commands on remote endpoints.
Detects the use of native Windows utilities (vssadmin, wmic, bcdedit, wbadmin) to delete volume shadow copies, disable system recovery, or remove backup catalogs, which are common actions taken by ransomware to inhibit system recovery.
Detects persistence mechanisms used by the Mustang Panda threat actor (specifically the SHARDLOADER/ZOHOMURK malware variants). The rule monitors for the creation or modification of Windows Run registry keys using specific, known malicious value names (e.g., 'MediumNetMonIt', 'MicrosoftEdgeUpdateBrokerTask') or pointing to suspicious file paths located in 'C:\ProgramData\IDM\logs\' or within the 'VaultCache' folder.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects outbound SSH connections to TCP port 2222 that exhibit specific cipher negotiation patterns (curve25519-sha256 and chacha20-poly1305@openssh.com) associated with a known malicious SSH server exploit scaffold for CVE-2026-55200. This vulnerability involves a pre-authentication heap out-of-bounds write in libssh2 clients.
Page 30 of 119