Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects file modification patterns consistent with Interlock ransomware including characteristic file extensions and ransom note creation.
Detects Node.js processes performing credential enumeration with patterns matching OtterCookie backdoor behavior targeting wallets, passwords, and keys.
Detects network connections to Google Sheets API endpoints indicative of Living Off Trusted Services C2 technique
Detects network connections to Cloudflare tunnel domains associated with Hive0163 threat actor command and control infrastructure.
Detects Python processes accessing paths associated with Invisible Ferret backdoor deployment including .n2/pay, .npl, and .n2/bow directories.
Detects mshta.exe executing remote or inline scripts, commonly abused for initial access in LOTL attacks
Detects outbound connections from network appliances to external IPs that may indicate command and control activity post-exploitation
Detects certutil.exe being used to download files from remote URLs, a common LOTL technique for payload delivery
Detects regsvr32.exe with scrobj.dll loading remote scriptlets to bypass application whitelisting
SharpSCCM Indicators
YARA-L
Detects the use of SharpSCCM, a post-exploitation tool designed to abuse Microsoft System Center Configuration Manager (SCCM)
for lateral movement and privilege escalation. Its execution may indicate adversarial attempts
to leverage enterprise management infrastructure for discovery, remote execution, or privilege escalation.
for lateral movement and privilege escalation. Its execution may indicate adversarial attempts
to leverage enterprise management infrastructure for discovery, remote execution, or privilege escalation.
Page 16 of 22