Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects rundll32.exe executing inline JavaScript/VBScript via the
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
mshtml RunHTMLApplication export or a script payload staged in user-writable
directories. ClickFix chains abuse rundll32 to proxy script execution past
application controls without dropping a conventional executable.
Detects a burst of file modifications producing common
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
ransomware encryption extensions on a single host within a short window. This
captures the destructive-scripting / data-encryption impact behaviour that
AI-assisted cybercrime can drive, where a script rapidly renames or rewrites
large numbers of files after execution.
Detects PowerShell being launched directly from the Windows Run dialog
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
(explorer.exe parent) with a hidden window and a download/execution cradle in the
command line. This is the core artifact of ClickFix campaigns, where the victim is
lured to an Amazon-themed decoy page, copies a pasted command, and executes it from
Run to retrieve and run the next-stage malware.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects a web server process (apache2, httpd, php-fpm) spawning a Unix shell (dash/sh) that executes discovery commands such as id, whoami, hostname, or find. This is the durable post-exploitation signature of the wp2shell WordPress pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137), where a malicious plugin or webshell executes commands through the web stack.
Detects shadow copy destruction and recovery feature tampering used
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
by Akira and other ransomware families to prevent victims from restoring data.
Covers vssadmin / wmic shadowcopy deletion, wbadmin catalog deletion and
bcdedit recovery-disabling commands executed from the command line.
Detects an AhsayCBS / Tomcat / Java web service process spawning a
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
command or script interpreter. After exploiting AhsayCBS, attackers executed
shell commands through the dropped webshell to run reconnaissance and download
the XMRig payload. A backup web service should never directly spawn cmd.exe,
powershell.exe, or a Unix shell - this indicates webshell command execution.
Detects shell or interpreter processes spawned as children of the
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE,
CWE-94) in the management interface results in the web server process forking
unexpected /bin/sh, curl, wget or scripting interpreter children to run
post-exploitation commands on the management plane.
Detects HTTP requests to the PeopleSoft PSEMHUB servlet using alternate
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
encodings such as the percent-encoded path %50SEMHUB. ShinyHunters/UNC6240 mass-exploit
Oracle PeopleSoft CVE-2026-35273 against internet-facing systems and encode the path to
defeat literal WAF signatures for /PSEMHUB/ (T1190, T1027).
Detects a PHP file being written into a WordPress content directory
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
that has no legitimate reason to hold executable code. The wp2shell chain against
CVE-2026-63030 and CVE-2026-60137 stages its payload through wp-content/uploads/
and wp-content/upgrade/ before it lands as a plugin under
wp-content/plugins/wp2shell_/, so both the staging directories and the
campaign's plugin directory shape are matched. uploads/ is the durable half:
WordPress serves user media from it and nothing there should ever be a .php file,
which makes a PHP write there a strong webshell indicator independent of this
campaign.
Page 2 of 22