Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects the use of WMIC to create processes on remote nodes, a technique observed with the Gentlemen ransomware for propagation. This rule specifically looks for 'wmic.exe' executions with command-line arguments indicating remote node targeting and process creation.
Detects rundll32 executing the unusual mcrypto.chiper or mcrypto_clean exports. The misspelled export naming is tied to the compromised DAEMON Tools post-installation stage, indicating potential malicious activity related to the DAEMON Tools backdoor.
This rule detects the behavior of a temporary executable making a network connection and then deleting itself shortly afterwards. It specifically looks for file creation and deletion events of executables within temporary directories (e.g., \temp or \appdata\local\temp) where the context process is a command-line interpreter or another executable. The rule's logic is designed to identify specific malware structures like SessionGate, Remus, or AnimateClipper rather than generic executable names.
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
This rule detects the presence of a cluster of DLL names commonly associated with anti-analysis techniques used by malware, specifically Sprysocks. The DLLs 'snxhk.dll', 'SxWrapper.dll', 'SxIn.dll', 'SXIn64.dll', 'SbieDll.dll', and 'cmdvrt32.dll' are checked by malware loaders to identify sandbox or packet-capture environments. The rule triggers if at least three of these DLL names are found, indicating an attempt by malware to evade detection or analysis.
This rule detects the launch of a process where its command line contains references to 'RawWNPF' or '\device\rawwnpf'. This pattern is often associated with malicious activity, specifically related to the 'Fishmonger's Arsenal' campaign and the 'SprySocks' malware, which utilize RawWNPF for inter-process communication or other low-level operations. The rule focuses on capturing the principal and target context for further correlation and investigation.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
Page 23 of 98