Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
This rule detects the use of the JSON-RPC 'eth_call' method by a non-browser process during network communication. It specifically looks for network connection events where the initiating process is not a common web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting dynamic command or address resolution.
Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing, which are indicative of malicious discovery.
Detects PowerShell executing a reflective .NET assembly load, indicated by keywords like 'Reflection.Assembly', 'Load', and 'byte' in the command line. The detection is further refined by looking for 'Extension.SubRoutine', 'Run2', or the C2 domain 'hellolargeworld.com' in the command line, and specifically targets instances where the initiating process is 'node.exe'. This behavior is indicative of the 'protocal.cjs' backdoor.
Page 2 of 98