Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects the creation of files or directories containing the string 'swsecret', which is a hard-coded artifact used by the ShadowGuard eBPF rootkit for concealment.
Detects the use of custom kill signals (-900, -901) which are used by the ShadowGuard eBPF rootkit to add or remove a process from its allow-list for kernel-level concealment.
Detects the specific SHA256 hash of a Rust-based DLL loader (DWrite.dll) used for DLL sideloading and redundant payload delivery associated with the 'OpenClaw Agent' malware campaign.
Detects creation and/or attempted execution of C:\ProgramData\CertificationKit.ini, a staging path observed in MuddyWater VBA dropper activity. This rule correlates file creation with suspicious execution attempts (cmd.exe referencing the INI path) on the same host within a short window to increase fidelity.
Detects PowerShell or Batch scripts attempting to download files from known malicious C2 domains (darkgptprivate.com, getintwopc.site). This activity is a fallback mechanism associated with the 'OpenClaw Agent' malware campaign
Detects file creation or process execution events where the observed SHA256 matches known EchoGather backdoor or associated XLL loader samples linked to the Paper Werewolf (GOFFEE) threat group. This is a high-confidence IOC-based detection. Use it for rapid triage and scoping; follow up with behavioral detections for durable coverage.
Detects an anomalously high rate of network connections to a MongoDB server from a single source IP, a pattern associated with the exploitation of MongoBleed (CVE-2025-14847).
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
Page 18 of 22