Rule Library
Sigma Rules
2 rules found for "Jason Rathbun (Blackpoint Cyber)"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
Remote Access Tool - ScreenConnect Server Web Shell Execution
Detects potential web shell execution from the ScreenConnect server process.
WindowsProcess Creation
Jason Rathbun (Blackpoint Cyber)Mon Feb 26windows
Emerging Threathighexperimental
Suspicious Process Spawned by CentreStack Portal AppPool
Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)
WindowsProcess Creation
Jason Rathbun (Blackpoint Cyber)Thu Apr 172025