Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Detects systematic enumeration of application registrations, owners, credentials, and permissions through Microsoft Graph. This rule identifies suspicious activity where a user or application makes a high volume of GET requests to various Microsoft Graph API endpoints related to application registrations within a short time frame (15 minutes). The specific endpoints monitored include those for listing applications, owners, password credentials, key credentials, and required resource access. A threshold of 40 requests within a 15-minute window triggers the alert, indicating potential reconnaissance or inventory collection by an adversary.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
SSL VPN password spray ending in success
Cortex XDR
This rule targets high-volume account failures followed by a successful tunnel or portal authentication on SSL VPNs. It aims to detect password spraying attacks that eventually lead to a successful login, providing causality fields for investigation.
This rule detects suspicious executable or DLL file creations in common temporary or user-writable directories shortly after a Microsoft Defender related process (MsMpEng, Nissrv, Werfault, Services) terminates unexpectedly. The rule focuses on the causality chain to link the Defender crash with the subsequent file placement, suggesting an attempt to bypass or disable security software before deploying malicious payloads.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
This YARA rule detects the Nimplant malware, a lightweight C2 framework. It identifies Nimplant by looking for specific DLL and library names (some with common typos), a comprehensive list of Nim-related source file names often found in Nimplant builds, specific hexadecimal patterns corresponding to Windows API calls (like GetComputerNameW, CreateProcess, GetUserNameW, OpenProcessToken, CreateFileA, VirtualProtect, CreateToolhelp32, WinHttpConnect), Zlib compression patterns, TLS callback patterns, and various strings including registry keys and a version string for Nimplant itself. The rule aims to identify Nimplant executables or related artifacts on Windows systems.
Page 24 of 98