Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects a process launch whose command line both references a cron persistence path (crontab, /etc/cron.d/, /etc/crontab, /etc/cron.{hourly,daily,weekly,monthly}/, /var/spool/cron/crontabs/) and contains a download-and-execute or reverse-shell marker (curl/wget piped to a shell, /dev/tcp/ redirection, base64-decoded payload, nc -e) or installs the crontab from a file staged under /tmp/. Attackers commonly install a scheduled cron entry so a malicious command re-executes on a fixed interval, surviving reboots and process kills (T1053.003).
Detects an npm or pip package installation process spawning a script
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
interpreter or living-off-the-land binary (powershell, cmd, certutil, bitsadmin, curl,
wget, bash, sh) as a child process. CrowdStrike's 2026 Threat Hunting Report found
adversaries increasingly embed malicious setup/install scripts inside open-source packages
uploaded to npm and PyPI; these scripts execute automatically the moment the package is
written to disk during npm install / pip install, unless intercepted before execution. A
package manager process spawning a scripting engine or download utility immediately after
install is a strong indicator of an embedded malicious postinstall/setup script rather than
a normal build step.
Detects usage of vssadmin or wmic to delete Volume Shadow Copies
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
as observed in The Gentlemen ransomware operations to prevent system recovery
before encryption deployment.
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
Detects curl.exe writing an MSI package into the ProgramData
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
Detects SSH clients launched with reverse (-R) or dynamic (-D) port
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects creation of a new local administrative account on or through a
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Detects modification of core Ivanti Connect Secure system files on the
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Page 4 of 22