Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects attempts by non-browser executables to access DPAPI (Data Protection API) for decryption, specifically when the command line also references Chromium Local State. This behavior is indicative of credential theft, where an attacker might be trying to extract stored browser credentials. The rule filters out legitimate browser processes (Chrome, MS Edge, Brave) to reduce false positives and focuses on the causal chain of events.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects when a non-Discord process creates or modifies both 'index.js' and 'package.json' within a Discord desktop core module directory. This file pair is critical for Electron module loading and is often targeted by malware like VVS Stealer to establish persistent session interception.
Detects a process creating both the PyArmor runtime module and Python 3.11 runtime library in user-writable locations. The component pairing is consistent with execution staging for the PyInstaller-packaged, PyArmor-protected VVS sample.
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
Page 21 of 98