Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects remote management software launched from an existing RDP session, indicating nested remote access or pivoting.
This rule detects the execution of a specific command-line sequence involving 'cmd.exe' that is characteristic of the ClickFix attack. The sequence includes moving an 'update.zip' file from the user's downloads, extracting a 'u.zip' file in the temporary directory, and then executing 'update.bat'. This pattern is often associated with malicious copy-paste techniques.
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects Python or a shell replacing the installed Chrome build with an older package before installing a wallet extension that requires Manifest V2 capabilities. This activity is associated with the InvisibleFerret malware.
Detects PowerShell referencing AMSI internals, reflection, or amsiInitFailed before executing a downloaded stage. This rule specifically looks for PowerShell processes executing commands that contain keywords related to AMSI bypass techniques, such as 'AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'amsiContext', 'GetField', combined with 'SetValue', 'Reflection', or 'NonPublic'. This indicates an attempt to modify AMSI's behavior in memory.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
Detects mshta executing a remote HTA, JavaScript, or HTML resource from a browser-driven installation chain. This rule specifically looks for mshta.exe being executed with a command line containing a URL (http/https) or script protocol (javascript/vbscript) followed by file extensions or keywords commonly associated with malicious scripts or payloads (.hta, .js, .html, payload, install).
Page 17 of 98