Arnold Chan
@slazTrusted contributorCompletionist
2 followers1,966 downloads3,573 copies44 likes20,333 views
7,399 detections
Filters
Last updated
All Time
Detection languages
5,494
1,006
394
169
98
Categories
2,311
1,792
1,178
1,003
910
Platforms
4,111
1,552
1,220
660
658
Products / Services
2,750
1,003
991
705
485
MITRE Techniques
2,072
1,500
1,388
1,065
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
Detects Python processes (python.exe, pythonw.exe, py.exe) executing with high or system integrity levels and interacting with named pipes, a technique often used for inter-process communication, persistence, or process injection.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects PDF documents that impersonate Notion invitation notifications and incorporate multiple redundant/overlapping URI links. This technique is used by the threat actor DOUBLOON DREDGER to facilitate EvilTokens device code harvesting campaigns.
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
This rule detects potentially malicious memory manipulation and thread execution activity originating from the ERAAgent.exe process. It specifically identifies when ERAAgent.exe calls VirtualProtect or VirtualAlloc to set memory as PAGE_EXECUTE_READWRITE, followed shortly by a CreateThread or CreateRemoteThread operation. This behavior is indicative of process injection or reflective code loading, where an executable image is manually mapped into memory and executed, bypassing traditional file-based detection.
Page 735 of 740