Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
EchoCreep Decodes AES-CBC Base64 Command
Cortex XDR
Detects a non-browser process combining base64 decoding with AES-CBC processing before launching shell commands. This behavior is indicative of the EchoCreep malware, which uses sophisticated obfuscation techniques to hide its command and control communications.
Detects a benign executable loading a nearby DLL that reads and executes a data file containing an embedded .NET backdoor. This technique is often used by threat actors to evade detection by leveraging legitimate processes and file types.
This rule detects the launch of a process where its command line contains references to 'RawWNPF' or '\device\rawwnpf'. This pattern is often associated with malicious activity, specifically related to the 'Fishmonger's Arsenal' campaign and the 'SprySocks' malware, which utilize RawWNPF for inter-process communication or other low-level operations. The rule focuses on capturing the principal and target context for further correlation and investigation.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Detects bash or sh executing a fanout script from a temporary directory. This behavior is often associated with lateral movement or propagation activities by adversaries.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
This YARA rule detects a specific PDB (Program Database) path associated with the SessionGate 7ZipDownloader malware. The presence of this string in a file indicates that the file is likely a component of the SessionGate malware, specifically its 7ZipDownloader module. PDB paths are often left in compiled binaries and can serve as unique indicators for specific malware families or development environments.
Page 15 of 98