Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects mass service termination targeting backup, database, and virtualization services. The Gentlemen stop Veeam, SQL, Oracle, SAP, Acronis, BackupExec, PostgreSQL, Docker, and VMware services before encryption.
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Detects execution of BRICKSTORM malware components including BRICKSTEAL credential harvester, pg_update, vmp utilities, and SLAYSTYLE tools used in vSphere infrastructure attacks.
Detects The Gentlemen ransomware execution. The ransomware requires a --password flag (8-byte key) and optionally --path for targeted encryption. Creates README-GENTLEMEN.txt ransom notes, appends .7mtzhh extension, and drops self-deleting batch files for cleanup.
Detects recovery inhibition commands used by The Gentlemen including Recycle Bin deletion, RDP log wiping, and Prefetch file removal to prevent forensic investigation and data recovery.
Detects NetExec SMB-based malware deployment across network ranges.
The Gentlemen use nxc smb with atexec/smbexec to disable Defender, mount shares
via net use, and execute ransomware (cerv.exe) across entire subnets. Also
detects creation of open shares with Everyone:FULL access.
The Gentlemen use nxc smb with atexec/smbexec to disable Defender, mount shares
via net use, and execute ransomware (cerv.exe) across entire subnets. Also
detects creation of open shares with Everyone:FULL access.
Detects significant file creation in 'C:\ProgramData\data\' used by The Gentlemen as a staging area for data consolidation before exfiltration via rclone or WinSCP SFTP connections.
Detects rclone execution with exfiltration patterns consistent with The Gentlemen operations. They use rclone copy with multi-threaded streams, bandwidth limits, and file type exclusions (exe, msi, mp3, avi, iso) for organized data theft via SFTP.
Page 13 of 22