Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects remote support software being added to common user or machine Run and RunOnce registry persistence locations. This rule specifically looks for modifications or creations within the 'Run' and 'RunOnce' registry keys that contain strings associated with known remote access or management tools such as AnyDesk, Bomgar, BeyondTrust, Zoho, ScreenConnect, Splashtop, Atera, SuperOps, and TeamViewer. This activity could indicate an attacker establishing persistence on a compromised system.
Detects ScreenConnect or another remote support process directly spawning a mining executable or script. This rule identifies suspicious process creation where a known remote management tool (ScreenConnect, ConnectWiseControl, ClientService) initiates a process with command-line arguments or filenames indicative of cryptocurrency mining (e.g., xmrig, lolminer, nbminer, stratum, wallet, gpu).
Detects a utility-themed parent process launching msiexec with a ScreenConnect or remote support installer and quiet options. This behavior is often associated with adversaries attempting to establish remote access covertly.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
Detects an executable creating a copy of itself in the current user's Startup folder by comparing the target name or hash with the initiating process. This method is often used by malware to establish persistence and regain execution when the user signs in.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service. This activity can indicate an attacker attempting to gain access to sensitive data stored in Azure Storage Accounts.
Page 13 of 98