Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads962 copies13 likes34,167 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Hunting rule: correlate with additional signals before alerting.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Hunting rule for "Dump Credential Manager using keymgr.dll and rundll32.exe" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Hunting rule: correlate with additional signals before alerting. Detects PowerShell FileStream open on \\.\<volume> to read raw boot sector bytes.
Detects nltest domain_trusts combined with net view — TrickBot-style AD/network recon.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port (e.g. 22/tcp) to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port (e.g. 22/tcp) to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
correlate with additional signals before alerting.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.
Page 9 of 38