Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects PowerShell reflective assembly loading with byte array reversal technique used by APT36 SheetCreep
Detects network communication to known APT36 Havoc C2 infrastructure IP addresses
Detects scheduled task creation with naming patterns matching APT36 CreepDropper persistence mechanism
Detects silent installation of Cloudflare tunnel client which may establish covert C2 channels
Detects outbound network connections to AWS Lambda function URLs which may indicate HazyBeacon backdoor or similar cloud-based C2
Detects Node.js processes performing clipboard monitoring or screenshot capture using npm packages like screenshot-desktop, consistent with Contagious Interview spyware.
Detects curl or wget commands fetching scripts from vercel.app or URL shorteners and piping to shell execution, consistent with Contagious Interview initial access.
Detects execution of Velociraptor which may indicate threat actor using legitimate EDR tool for malicious C2
Detects Visual Studio Code or Cursor spawning shell processes, indicating potential exploitation of repository task configurations for malicious execution.
Detects execution of Warcode Crystal-based shellcode loader from common writable public directories used by APT36
Page 15 of 22