Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects ransom note creation associated with Yurei ransomware.
Detects PowerShell execution launched by a batch script located in a user's Startup folder, where the PowerShell command line contains common download primitives. This pattern aligns with persistence via Startup folder (BAT) combined with retrieval of a next-stage payload, as reported for Paper Werewolf (GOFFEE) activity.
Detects APT28's NotDoor backdoor deployment using DLL sideloading technique via legitimate signed OneDrive.exe. Loads malicious SSPICLI.dll to disable Outlook macro security and install VBA backdoor targeting NATO organizations.
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
Detects APT28's NotDoor backdoor registry modifications to establish persistence and disable Outlook macro security. Modifies LoadMacroProviderOnBoot, Level, and General registry keys to enable silent macro execution.
Detects APT28's NotDoor VBA backdoor in Microsoft Outlook monitoring emails for trigger words like 'Daily Report'. Uses obfuscated VBA code with Application_MAPILogonComplete and Application_NewMailEx events for persistence and email-based C2.
Detects creation of SesameOp marker and exception files used by the OpenAIAgent.Netapi64 implant. Observable files include marker 'Netapi64.start' and exception logs 'Netapi64.Exception' created under 'C:\Windows\Temp\'; creation of either file is a high-fidelity indicator of SesameOp loader activity.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Detects PowerShell reconnaissance commands associated with SocGholish/RomCom activity, where PowerShell is invoked with embedded double quotes to evade simple detections.
Page 20 of 22