Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Hola monitor service persistence
Cortex XDR
This rule detects the persistence mechanism of the 'hola_monitor_svc' service or 'HolaMonitorService.exe' being configured for automatic start. It specifically looks for registry modifications related to this service. The XQL view includes actor and causality fields to aid in investigation.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
This rule detects instances where a web browser (Chrome, MS Edge, Firefox, or Brave) spawns a command prompt (cmd.exe) with a suspicious command line. The command line is characterized by containing a long string (at least 40 characters) within the user's temporary directory (%temp% or \temp\) and multiple command separators (&&, & rem, tar -xf, or rundll32). This pattern is indicative of the 'ClickFix' attack, often involving malicious copy-pasting from a browser into a command prompt.
VSPMsg print processor persistence
Cortex XDR
This rule targets registry or file artifacts that install 'VSPMsg' as an x64 print processor. It specifically looks for registry modifications where the value name contains 'print processors\vspmsg' and the event subtype or actor process command line contains 'vspmsg.dll'. The XQL view retains actor and causality fields for investigation.
Security Driver and Service Enumeration
Cortex XDR
This rule detects attempts to enumerate security-related drivers and services, specifically targeting ESET, Npcap, NPF, and Sysmon components. It looks for command-line utilities like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' being used with specific driver/service names. The XQL view includes actor and causality fields for investigation.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects when a newly dropped executable, likely from temporary or download directories, performs broad registry reconnaissance. Specifically, it looks for access to registry keys related to software, internet settings, credentials, vaults, and uninstall information. The XQL view includes actor and causality fields to aid in investigation.
This rule detects persistence attempts using Image File Execution Options (IFEO) debugger redirection for 'vds.exe'. Specifically, it looks for registry modifications where the 'debugger' value for 'vds.exe' points to an executable located within the 'Windows\Fonts' directory. This technique is often used by adversaries to maintain access or elevate privileges by hijacking legitimate application execution.
Page 28 of 98