Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects emails with PDF attachments containing code of conduct
themed content as observed in multi-stage phishing campaigns. These PDFs contain
malicious links that redirect users through CAPTCHA and staging pages to credential
harvesting sites with AiTM token compromise capabilities.
themed content as observed in multi-stage phishing campaigns. These PDFs contain
malicious links that redirect users through CAPTCHA and staging pages to credential
harvesting sites with AiTM token compromise capabilities.
Detects HTTP requests to CAPTCHA and intermediate staging pages used in code of conduct phishing campaigns. These pages filter out automated defenses and reinforce legitimacy before redirecting to AiTM authentication flows.
Detects common LOLBins spawned by Microsoft Office applications, indicating potential macro-based initial access leading to execution
Detects exploitation attempts targeting CVE-2023-33538 vulnerability in TP-Link routers. Identifies HTTP GET requests to the /userRpm/WlanNetworkRpm endpoint with command injection payloads attempting to download and execute Mirai-like botnet malware.
Detects non-Defender processes accessing mpasbase.vdm signature definition files. The BlueHammer exploit acquires a batch oplock on this file to freeze Defender mid-read, then swaps the underlying junction target to redirect SYSTEM-context reads to the SAM hive in a VSS snapshot.
Non-Defender access to VDM files has zero legitimate use cases.
Non-Defender access to VDM files has zero legitimate use cases.
Detects loading of offreg.dll (Microsoft offline registry library)
by non-standard processes. BlueHammer uses offreg.dll to parse the SAM, SYSTEM, and SECURITY hives extracted from a VSS snapshot, recovering the boot key and decrypting NTLM hashes without touching the locked live registry.
by non-standard processes. BlueHammer uses offreg.dll to parse the SAM, SYSTEM, and SECURITY hives extracted from a VSS snapshot, recovering the boot key and decrypting NTLM hashes without touching the locked live registry.
Detects potential DLL sideloading attack where msimg32.dll is loaded from non-system directories, a technique used by Qilin ransomware
Detects FoxitPDFReader.exe spawning suspicious child processes which may indicate DLL sideloading exploitation used by Qilin ransomware
Detects potential Event Tracing for Windows tampering through suspicious access to ntdll.dll memory regions, a technique used by Qilin ransomware to suppress telemetry
Detects network communication to IP addresses associated with BRICKSTORM malware operations targeting vSphere environments. These IPs have been observed in active campaigns compromising VMware vCenter and ESXi infrastructure.
Page 12 of 22