Ethan Andrews
@eandrewsTrusted contributorCompletionist
13 followers324 downloads7,488 copies113 likes78,864 views
1,181 detections
Filters
Last updated
All Time
Detection languages
1,181
Categories
476
426
188
169
125
Platforms
820
300
136
59
49
Products / Services
504
78
66
60
56
MITRE Techniques
431
415
293
251
160
CVEs
11
5
5
5
4
Detects Add-MpPreference invocations that add a Windows Defender exclusion for the TEMP folder, the C:\ root drive, or the .exe/.msi file extensions, a technique used to blind Defender ahead of malicious MSI/EXE installation.
Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.
Detects the deletion of the 'Zone.Identifier' alternate data stream from a downloaded .msi file, followed closely by the execution of that file using 'msiexec.exe'. This pattern is a known technique for bypassing Windows Mark-of-the-Web (MOTW) protections, which normally trigger SmartScreen warnings or Restricted View protections for internet-downloaded files.
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Detects phishing attempts where the sender's display name implies a sensitive role (e.g., Accounts Payable, Helpdesk, Vendor) while the authenticated header-From domain utilizes a 'support' subdomain. The rule triggers when the organizational root domain extracted from the email sender address does not match the branding present in the sender display name, indicating potential brand impersonation or business email compromise.
Detects the deployment and execution of GSocket-based persistence mechanisms on Linux systems. This includes monitoring for the use of deployment scripts (gs_deploy.py, gs_persist.py), the establishment of cron jobs for periodic GSocket check-ins, the use of GSOCKET_HOST environment variables to control network behavior, and the execution of GSocket binaries staged in suspicious locations such as /tmp/.gs or web server directories.
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Detects the delivery of a malicious SVG data-URI payload targeting the CVE-2026-42897 vulnerability in Outlook Web Access (OWA). This exploit uses a base64-encoded SVG image embedded in an email body, which triggers an onload JavaScript handler when rendered by OWA, leading to potential code execution within the mailbox context.
Detects use of process-dumping utilities (procdump) or the rundll32 comsvcs.dll MiniDump technique invoked against chrome.exe, consistent with an unprivileged process reading browser process memory to extract the passkey Security Domain Secret (SDS) master key (Golden Pass-ta-key attack).
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
Page 9 of 119