Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a loop attempting 'net use' against multiple IPC$ shares and recording reachable SMB hosts. This activity is indicative of network reconnaissance, specifically looking for accessible shares on remote systems within a subnet.
Detects a game-delivered backdoor spawning cmd.exe with a command line unrelated to installation or game launch activity. The rule specifically looks for cmd.exe being spawned by processes with names containing 'bird', 'rok', 'game', 'launcher', 'update', 'python', or 'ruby', and executing a command line with '/c'.
GraphWorm Persists through a Run Key
Cortex XDR
Detects the creation or modification of a Windows Registry Run key that points to an executable with names associated with GraphWorm or C2OverOneDrive malware, or an unusual OneDrive-themed binary located outside of legitimate OneDrive client paths. This rule specifically looks for registry events where the key name contains 'CurrentVersion\Run' and the data contains 'C2OverOneDrive', 'GraphWorm', 'OneDrive.*AppData', or 'config.dat'.
Detects a custom frp process enabling both reverse proxy and SOCKS5 functionality from an endpoint not approved as a proxy server. This rule specifically looks for process creation events where the executable name matches common frp variants (wormfrp, frpc, ssh) and the command line arguments indicate the setup of a reverse proxy, SOCKS5 tunnel, or related server connection parameters.
Detects a process launched from an OpenClaw skill enumerating debugger, packet-capture, process-monitoring, sandbox, or virtual-machine utilities before payload execution. This behavior is indicative of malware attempting to identify analysis environments.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the same authentication session or token identifier used from geographically inconsistent locations within a short period. This could indicate session hijacking or an adversary using a compromised session from a different location.
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects a session issued through browser MFA and subsequently used through a non-interactive, mobile, or command-line client. This behavior is indicative of an adversary potentially using a stolen session token to bypass multi-factor authentication.
Page 12 of 98