Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
Detects rundll32 loading a DLL from common user-writable directories (Downloads, Temp, AppData, or ProgramData) which is a known technique used by malware like InstallFix to execute newly downloaded stages.
GraphWorm Writes Shell
Cortex XDR
Detects the creation of the distinctive 'beacon_shell_output.txt' file in common temporary directories (Temp, AppData, ProgramData) after command execution, which is indicative of GraphWorm (Webworm) activity.
BirdCall Collects Clipboard Content
Cortex XDR
Detects an unsigned process using clipboard-related command-line or module indicators before writing local collection data. The rule specifically looks for process image names containing "bird", "call", "update", or "service" (case-insensitive) combined with command-line arguments or module indicators related to clipboard access such as "clipboard", "GetClipboardData", "OpenClipboard", or "CF_UNICODETEXT".
Detects `cmd.exe` spawned by a Discord-enabled backdoor after command decoding rather than by an interactive user or administrative tool. The rule specifically looks for `cmd.exe` executing commands (`/c`) where the parent process is identified as `searchapp.exe`, `echocreep.exe`, `service.exe`, or `update.exe`.
Detects the staging of operational executables (like FRP, proxy tools, secrets dumpers, or scanners) within web application administration directories or repository checkouts. This activity is suspicious as these directories should primarily contain source code or web application files, not executable tools. The detection specifically looks for these executables being created or modified by processes commonly associated with code repositories or command-line operations (git, powershell, curl, cmd).
Scripted Ping Sweep Detection
Cortex XDR
Detects a command loop executing a ping sweep across an entire subnet and writing responsive hosts to 'alive_hosts.txt'. This activity is indicative of network reconnaissance.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Page 22 of 98