Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
Detects a web server or PHP runtime creating or renaming a PHP file inside a REDCap application directory. INFINITERED trojanised legitimate REDCap components and deployed PHP-based persistence. Production REDCap content should normally be changed through controlled deployment or upgrade activity, so unplanned PHP file creation by the serving process requires investigation.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.
Detects a script constructing a URL or request path from hostname, username, machine GUID, or volume serial information before downloading a second stage. This behavior is associated with the InstallFix malware.
Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
EchoCreep Downloads a Tool
Cortex XDR
Detects the curl utility being launched by processes associated with EchoCreep or similar backdoor activity (searchapp, service, update, cmd) to download files, indicated by the use of output flags (-o, --output, -L, --remote-name). This activity is indicative of an adversary establishing persistence or downloading additional tools after initial compromise.
Page 25 of 98