Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Page 27 of 98