100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,449 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
This rule detects attempts to obfuscate the `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` registry key path by inserting various special characters between the letters. This technique is often used by malware to establish persistence and evade detection.
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.
This rule detects the Cruloader malware based on specific strings found within its binaries. The first rule, 'Loader_Cruloader_Strings', identifies the malware by looking for an RC4 key, a ROT13 charset, and the string "cruloader" itself. The second rule, 'Loader_Cruloader_Crypto', identifies the malware by looking for specific byte patterns indicative of its cryptographic routines, likely related to its RC4 implementation.
These rules detect encrypted ZIP files that contain only a single entry. The rules further specialize to detect if that single entry is a VBScript (.vbs) or Microsoft Management Console (.msc) file. This pattern is often used by adversaries to deliver malicious payloads, bypassing email security solutions that might not scan encrypted archives or might not recognize the malicious intent of single-entry archives containing specific script or configuration file types.
Detects the usage of the Windows native Cipher tool within PowerShell or cmd.exe to wipe the contents of the C Drive. The rule specifically looks for the 'cipher /W:C' command, which is used to remove data from available unused disk space on the C: drive, making previously deleted data unrecoverable.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
This rule detects macOS malware associated with the North Korean threat actor group CitrineSleet (also known as AppleJeus or UNK_JuiceHead). It specifically identifies binaries that exhibit consistent Dylib and Entitlement usage patterns observed in variants like UpdateAgent, SimpleTea (aka POOLRAT), and CrashReporter. The detection is based on matching specific hashes for the dylib and entitlement sections within Mach-O executable files.
This rule detects HTML content that is structured to resemble an imageless QR code, typically rendered using an HTML table. It looks for the presence of both black and white color definitions (hex codes #FFFFFF and #000000) in conjunction with HTML table tags (<table> or <td) and color styling attributes (background-color: or color:). This technique can be used for obfuscation or to embed data in a way that might bypass traditional image-based QR code detection.
Page 4 of 5