Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects an iox-derived proxy process generating a key and initialisation vector while configuring hard-coded forwarding settings. This behavior is indicative of the SmuxProxy malware, which is known to use these techniques for encrypted communication and data forwarding.
Detects registration or activation of a .NET COM object from a writable path before an in-memory payload is supplied. This rule specifically looks for command-line arguments containing COM-related keywords (regasm, regsvcs, comvisible, clsid, inprocserver32) in conjunction with common writable user-controlled directories (appdata, programdata, temp, users\public).
Detects the Kazuar malware removing job instructions and result files from its working directory after exfiltration or task completion. This rule specifically looks for file deletion events (EventCode 23 or 26 in Sysmon) where the file path matches patterns indicative of task, job, result, output, or stage files with common extensions like json, dat, bin, txt, or zip.
Detects a module parsing a large in-memory configuration blob without opening an external configuration file in the same start window. This behavior is indicative of the Kazuar malware loading its configuration directly from its executable rather than a separate file, which is a common obfuscation technique.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects the execution of PsExec (psexec.exe or psexec64.exe) with command-line arguments indicating remote execution to a network share and the use of administrative credentials (e.g., -s, -u, -p, -c). This activity is often associated with lateral movement and remote service execution by attackers, including ransomware groups like 'The Gentlemen'.
Detects taskkill, PowerShell, Windows Management Instrumentation or command-shell activity that attempts to terminate Discord. This activity is often seen with stealers like VVS Stealer which stops active Discord processes before replacing application support files with injected JavaScript.
Page 26 of 98