Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects schtasks.exe creating a scheduled task named "Windows Defender Advanced Threat Protection Service" that launches defender.exe (a renamed Sangfor executable abused for DLL sideloading) with SYSTEM privileges at startup. This is the exact persistence mechanism HoneyMyte (Mustang Panda) uses to relaunch the CoolClient backdoor chain from the fake "Microsoft\Windows Defender" directory on every boot.
Detects wmic being used to add a Microsoft Defender exclusion for a fake "Microsoft\Windows Defender" installation directory. HoneyMyte (Mustang Panda) runs this command via the MSFT_MpPreference WMI class before dropping the CoolClient sideloader (defender.exe) and libngs.dll into that duplicated folder, ensuring the malware is never scanned. The legitimate Windows Defender path does not contain a "Microsoft\" subfolder, making this exclusion target distinctive.
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects creation of logAzure.txt, the relative configuration
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
Detects Chrome or Edge being launched in headless mode with the
remote debugging port flag enabled. msaRAT (Chaos ransomware) uses this to spawn
a hidden browser instance it then manipulates via Chrome DevTools Protocol (CDP)
to inject JavaScript, hijack browser functionality, and build a covert WebRTC
C2 channel that never touches the network directly from the malware process.
remote debugging port flag enabled. msaRAT (Chaos ransomware) uses this to spawn
a hidden browser instance it then manipulates via Chrome DevTools Protocol (CDP)
to inject JavaScript, hijack browser functionality, and build a covert WebRTC
C2 channel that never touches the network directly from the malware process.
Detects a process loading AzureCommunication.dll, the .NET Native AOT-compiled Outlook-calendar C2 module used by Project CAV3RN. The controller (uxtheme.dll) resolves this DLL's single export, QueryInterface, and passes it a get_;;_<agent-id>_,_<legacy-url> or
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
Detects curl.exe writing an MSI package into the ProgramData
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
Detects creation of a GUID-named directory directly at the filesystem root (e.g. C:\{8-4-4-4-12 UUID}). LegacyHive creates this world-writable staging directory to hold a modified ntuser.dat hive and to anchor the NT object directory symbolic link chain used in the privilege escalation. The directory is created with an Everyone:GENERIC_ALL DACL and is removed during cleanup, giving it a short-lived footprint. Requires Sysmon Event ID 11 or equivalent file telemetry.
Page 8 of 22