Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects Chisel tunnel creation used by The Gentlemen for encrypted
C2 communication. They create reverse SOCKS proxies on port 443 with very low
AV detection rate, maintaining persistent internal network access.
C2 communication. They create reverse SOCKS proxies on port 443 with very low
AV detection rate, maintaining persistent internal network access.
Detects multiple failed FortiGate VPN login attempts using known default usernames, consistent with The Gentlemen brute force campaigns. They maintain ~969 validated brute-forced FortiGate VPN credentials and test anti-honeypot probe passwords with Russian garbage strings.
Detects execution of Impacket dpapi.py with backupkeys parameter,
used by The Gentlemen to extract DPAPI backup keys from domain controllers
for decrypting stored credentials across the domain.
used by The Gentlemen to extract DPAPI backup keys from domain controllers
for decrypting stored credentials across the domain.
Detects execution of ChromeKB3.exe, a custom tool developed by
The Gentlemen for extracting saved passwords from Google Chrome via AppBound
injection (SHA256: 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b).
The Gentlemen for extracting saved passwords from Google Chrome via AppBound
injection (SHA256: 2834114ff7e487c4ca3f50ca39f7d652dea1be98f885c388f01b6ff35309307b).
Detects execution of The Gentlemen custom EDR killer tools
All.exe and Allpatch2.exe that exploit vulnerable drivers to terminate
endpoint security processes at kernel level.
All.exe and Allpatch2.exe that exploit vulnerable drivers to terminate
endpoint security processes at kernel level.
Detects creation of scheduled task for rclone-based data
exfiltration. The Gentlemen create a task named SafeSync that runs 'rclone.ps1' at startup with SYSTEM privileges and HIGHEST run level.
exfiltration. The Gentlemen create a task named SafeSync that runs 'rclone.ps1' at startup with SYSTEM privileges and HIGHEST run level.
Detects silent AnyDesk deployment with password setting, used
by The Gentlemen for persistent remote access. They use --install combined
with --start-with-win --silent and --set-password, deployed via NetExec
or Conti-style PowerShell functions with hardcoded credentials.
by The Gentlemen for persistent remote access. They use --install combined
with --start-with-win --silent and --set-password, deployed via NetExec
or Conti-style PowerShell functions with hardcoded credentials.
Detects loading of vulnerable signed drivers used by The Gentlemen
for BYOVD-based EDR/AV termination at kernel level. Known drivers include
ThrottleBlood.sys (renamed ThrottleStop.sys) and viragt64.sys.
for BYOVD-based EDR/AV termination at kernel level. Known drivers include
ThrottleBlood.sys (renamed ThrottleStop.sys) and viragt64.sys.
Detects installation of Windows PowerShell Web Access (PSWA)
feature, used by The Gentlemen for persistent web-based PowerShell access.
They add wildcard authorization rules allowing all users on all computers.
feature, used by The Gentlemen for persistent web-based PowerShell access.
They add wildcard authorization rules allowing all users on all computers.
Detects creation of or addition to the ESX Admins Active
Directory group, used by The Gentlemen to exploit CVE-2024-37085 for
ESXi host takeover with full administrative access.
Directory group, used by The Gentlemen to exploit CVE-2024-37085 for
ESXi host takeover with full administrative access.
Page 14 of 22