Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,863 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This rule detects the creation or modification of the 'goopdate' registry value under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run path. This technique is used to achieve persistence by executing specified files (e.g., Sang.exe or defender.exe with the 'work' parameter) upon user logon.
Detects unauthorized macOS Screen Sharing (screensharingd) attachment attempts using the 'root' user account via the Secure Remote Password (SRP) authentication mechanism, specifically targeting an authentication bypass vulnerability.
Detects the invocation of the Windows Error Reporting service (WerFault.exe) where the command line arguments reference Zoom-related processes (Zoom.exe, CptHost.exe, or zoom.us). This behavior is often indicative of an abnormal application crash, which may be associated with memory corruption exploitation attempts against the Zoom client.
This rule detects successful SSH logins that follow a burst of at least 10 failed SSH authentication attempts from the same remote IP address to the same device within a 10-minute window, followed by a successful login within 15 minutes. This pattern is indicative of a successful credential brute-force attack, frequently associated with botnet propagation efforts.
This rule detects the creation or modification of cron jobs that schedule recurring tasks (every 5 or 10 minutes) designed to download remote scripts using wget or curl and pipe them directly into a shell interpreter (sh or bash) for execution. This behavior is indicative of persistent malware, such as botnets, re-fetching and executing secondary payloads.
Detects the creation of a local user account followed by the modification of the Winlogon SpecialAccounts\UserList registry key to hide the account from the Windows logon UI. This behavior is indicative of persistent access maintenance by adversaries, such as the Andariel threat group.
Detects the creation of a 'SystemIn.lnk' shortcut file within the Windows Startup folder, as well as the execution of temporary PowerShell scripts ('create_lnk_*.ps1') that use WScript.Shell to establish persistence. This behavior is associated with the QUICAgent backdoor attributed to Operation QUICSILVER.
Detects the use of the 'copy /b' command to reconstruct an executable payload (Windowsupdate.exe) by concatenating split decoy files (header.doc and body.doc) typically located within a _rels directory, a technique associated with malware delivery chains like Operation QUICSILVER.
Detects Zoom-related processes (zoom.us.exe, Zoom.exe, CptHost.exe) modifying registry keys within the Windows CapabilityAccessManager ConsentStore for webcam or microphone access. This activity indicates the system is recording the time a process initiated hardware access, potentially signaling unauthorized surveillance or post-compromise activity.
Detects anomalous child process creation by Zoom client executables (Zoom.exe, CptHost.exe, ZoomOpener.exe, zoom.us), specifically monitoring for command interpreters, script hosts, and browser processes, which may indicate exploitation of the Zoom client for code execution.
Page 4 of 119