100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,449 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
This rule detects the presence of source code files associated with the Suterusu Rootkit. It looks for specific function definitions ('hijack_start', 'hijack_pause', 'hijack_resume', 'hijack_stop') typically found in 'common.h', print strings related to rootkit functionality ('Dropping to root shell', 'Hiding TCPv4 port %hu', 'Unhiding TCPv6 port %hu', 'Enabling module loading', 'Silently prohibiting module loading') from 'sock.c', and a define statement ('#define SUTERUSU_INIT_WORK') from 'dlexec.c'. The rule triggers if at least three of the function definitions are found, or any of the print strings, or the define statement.
This rule detects attempts to exploit CVE-2023-23752 in Joomla. The exploit involves unauthenticated access to sensitive configuration information or user data via specific API endpoints. The rule looks for HTTP GET requests to '/api/index.php/v1/users?public=true' or '/api/index.php/v1/config/application?public=true' followed by a 200 HTTP status code, indicating a successful information disclosure.
This rule detects the SugarWraith loader DLL, which is associated with the UNK_SweetSpector threat group. It identifies the malware based on a combination of specific strings found within the binary, including error messages related to process and pipe creation, system information gathering strings, and network-related strings like "ngrok-skip-browser-warning" and "SecureProtocols". The presence of at least four of these strings indicates the potential presence of the SugarWraith loader.
This rule detects Portable Executable (PE) files that masquerade as PDF documents by embedding specific PDF-themed icons. The rule checks for the standard PE file magic bytes and then hashes the first resource (typically the icon) of the PE file. If the hash matches any of the known hashes for PDF red icons, it triggers an alert. This technique is commonly used by attackers to trick users into executing malicious files that appear to be benign PDF documents.
This rule identifies a specific NMAP executable by checking its PE header characteristics and MD5 hash. It looks for a 32-bit executable (pe.machine == pe.MACHINE_I386), a specific MD5 hash value ("bd457e3fb19a7f127a23369e70ee84fc"), a major linker version of 6, and a section named ".rdata" at index 1. This is intended to confirm if a file is a legitimate, specific version of the NMAP executable.
This rule detects elements commonly found in 3AM ransomware notes. It looks for the strings "threeam" or "3 am", a specific onion URL pattern associated with 3AM ransomware (e.g., http://threeam[0-9,a-z]*.onion or http://3am[0-9,a-z]*.onion), and at least one of the keywords "encrypted", "data", or "payment". The combination of these indicators suggests the presence of a 3AM ransomware note, likely indicating a ransomware infection or an attempt to communicate ransom demands.
Page 5 of 5