Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,863 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
This rule detects the creation of suspicious, hidden file structures within the user's 'Library/Application Support' directory on macOS, specifically targeting the directory name '.com.apple.accountsd'. It monitors for the placement of a file named 'AccountsHelper' or the creation of subdirectories commonly associated with the AMOS stealer malware (e.g., 'auth', 'cfg_cache', 'session', '.service'). The detection identifies potential evasion techniques where malware masquerades as legitimate Apple system components to persist or hide malicious activities from users.
Detects malicious script execution triggered by the CVE-2026-42897 XSS vulnerability in Outlook Web Access (OWA). The detection rule monitors AMSI script detection events for patterns associated with the OWAReaper exploit chain, which utilizes an 'onload=eval(atob())' loader to reconstruct a base64-encoded payload embedded in social-icon image tags within a browser session.
Detects the execution of the rclone utility followed by successful outbound network connections occurring outside of standard business hours (8:00 PM to 6:00 AM). Rclone is a legitimate cloud storage synchronization tool frequently abused by adversaries for data exfiltration. This pattern identifies potential unauthorized data staging and egress to remote cloud storage services during times when activity is less likely to be monitored.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
This rule detects persistence mechanisms associated with the AMOS (Atomic macOS) infostealer by monitoring for the creation of malicious LaunchAgent plist files or specific directory structures masquerading as 'com.apple.accountsd.helper'. It triggers on file events within specific hidden directories ('/Library/Application Support/.com.apple.accountsd/') or process execution events involving command lines that include both the 'com.apple.accountsd.helper' string and persistence flags such as 'RunAtLoad' or 'KeepAlive', which are indicative of a system-level process masquerade designed to maintain unauthorized access.
Detects inbound emails originating from a gmail.com sender that have not previously communicated with the recipient in the last 90 days. The rule identifies emails containing e-card or greeting card-themed subjects, which are often used as social engineering lures to masquerade as automated branded notifications for malicious activity or credential theft.
Detects potential business email compromise or phishing attempts by identifying inbound emails that pass authentication checks but involve a first-time sender-recipient pair (no correspondence in 90 days) referencing financial themes such as invoices, bank accounts, or purchase orders.
Detects the creation of scheduled tasks using specific naming patterns (GoogleUpdateService or MSEdgeUpdateService followed by a GUID) often associated with the CountLoader malware. This technique attempts to masquerade as legitimate Google or Microsoft Edge update processes to establish persistence.
Detects the creation of files named 'svchost.exe' within user Documents directories, excluding files located in 'C:\Windows\System32'. This rule identifies potential file masquerading, a tactic often used by adversaries to hide malicious binaries within legitimate system process names during post-exploitation activities.
Detects ClickFix social-engineering attacks where a user is tricked into pasting malicious commands into the Windows Run dialog. The detection monitors explorer.exe spawning cmd.exe or powershell.exe with specific command-line indicators, such as wildcard patterns used to obfuscate powershell.exe names, the 'ZZ1984' marker string associated with DOUBLECUP/ClickFix loaders, or specific loop structures ('for /f') designed to locate and parse payloads staged in browser cache.
Page 8 of 119