Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the execution of rundll32.exe where it attempts to load a DLL from common user-writable directories (Temp, AppData, Downloads, Users\Public) and specifically calls the 'Begin' export function. This behavior is often associated with malware attempting to execute malicious code via a legitimate Windows binary.
Detects a hidden PowerShell instance collecting hostname, user, domain, operating system, architecture, and security-product information. This behavior is indicative of reconnaissance activities often performed by malware like InstallFix.
Detects a script interpreter deleting a downloaded HTA, JavaScript, PowerShell, or batch file after persistence has been created. This behavior is often associated with malware like InstallFix to remove initial infection artifacts.
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects a batch or PowerShell loader reading 'msedge.txt' from a writable path (Temp, AppData, Downloads, ProgramData) and treating its content as encoded executable data. This behavior is indicative of the Banana RAT malware.
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Detects execution of a Brazilian invoice-themed batch file that launches hidden PowerShell and stages the banking trojan. This rule specifically looks for process creation events where the executable is 'cmd.exe' or 'powershell.exe' and the command line contains 'Consultar_NF-e.bat' or similar variations, indicating the use of a batch file named after a Brazilian invoice.
Detects a banking trojan creating command, task, response, or queue files in an application-data directory for asynchronous remote control. The rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file name contains keywords like 'command', 'task', 'queue', 'response', or 'job' with extensions like json, dat, bin, or txt. Additionally, it checks if the file path is within an AppData or ProgramData directory and if the context process is named 'banana', 'client', 'update', or 'service' with an .exe extension.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Page 11 of 98