Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects obfuscated PowerShell commands used to disable security features, such as AMSI bypass, disabling TLS certificate validation, and enabling Restricted Admin mode. This behavior is a known TTP of the Qilin ransomware group.
Detects MongoDB instances with a vulnerable configuration where 'zlib' is enabled for network message compression. This configuration makes the server vulnerable to MongoBleed (CVE-2025-14847).
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
Detects events involving indicators of compromise (IOCs) that are associated with currently active APT groups
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
Detects the execution of scripts (.ps1, .vbs, .php) with randomized or suspicious names from the Temp directory, where the parent process is explorer.exe, wscript.exe, or cscript.exe. This behavior is indicative of a dropper staging and executing its payload.
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
This detection rule identifies the creation of a Windows service with a suspicious or known malicious name, as logged by Windows Event ID 7045 (A service was installed in the system). Threat actors, including those associated with ransomware and other advanced persistent threats (APTs), often create services to achieve persistence, lateral movement, remote execution, or privilege escalation. Detection of such activity is critical for identifying early-stage post-compromise behavior.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
This detection rule identifies logins originating from suspicious remote systems commonly associated with penetration testing or malicious activity. These systems may include Kali Linux, Parrot OS, BlackArch, or other offensive security distributions. Such platforms are often used for reconnaissance, exploitation, credential harvesting, or lateral movement. The rule leverages indicators like unusual hostnames, known IP ranges, remote access patterns, or user agent strings to detect potentially unauthorized or anomalous access from these environments.
Page 19 of 22