Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects creation or restoration of ADMIN$, C$, or custom hidden shares used for remote ransomware deployment. This rule specifically looks for `net.exe`, `powershell.exe`, or `cmd.exe` executing commands that create or modify SMB shares, targeting administrative shares like ADMIN$, C$, or any share ending with a dollar sign ($).
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
Detects WinSCP command-line use that performs scripted uploads, synchronisation, or non-interactive transfer, which could indicate data exfiltration or automated file transfers.
Detects outbound TCP port 445 traffic (SMB) from a host identified as PeopleSoft, WebLogic, or PIA to a public IP address. This could indicate data exfiltration or forced authentication attempts.
Detects a command shell using cURL to download an MSI package and immediately install it silently with msiexec, matching a reported RMM delivery workflow. This rule specifically looks for command-line executions involving 'cmd.exe', 'powershell.exe', or 'pwsh.exe' that use 'curl' to download a '.msi' file and then execute 'msiexec' with silent installation flags.
Detects cdg.exe receiving a temporary module path together with the first_match argument used by the campaign to decrypt and execute embedded shellcode. This behavior is indicative of the DAEMON Tools backdoor.
Detects the addition of broad exclusion paths to Microsoft Defender, specifically targeting drive roots, administrative shares, or common working directories. This activity is often associated with ransomware, such as the 'Gentlemen Ransomware', to evade detection.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
This rule detects potential Animateclipper malware or similar cryptocurrency clipboard hijackers by identifying the presence of Windows API calls related to clipboard manipulation (GetClipboardData, SetClipboardData) in conjunction with regular expressions for common cryptocurrency addresses (Bitcoin, Ethereum) and the keyword 'clipboard'. The rule triggers if at least three of these indicators are present, suggesting an attempt to monitor and replace cryptocurrency addresses copied to the clipboard.
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Page 19 of 98