Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a file containing a cluster of strings commonly associated with Chromium credential stealing malware. The strings include references to Chromium profile database files like 'Login Data', 'Network\Cookies', 'History', and 'Web Data', as well as 'Local State' (often used for encryption keys) and the Windows API function 'CryptUnprotectData', which is used to decrypt DPAPI-protected data.
This YARA rule detects the presence of a credential stealer by identifying a cluster of file names commonly associated with Firefox profile data. The rule specifically looks for at least five out of seven distinct file names: 'key4.db', 'cert9.db', 'cookies.sqlite', 'logins.json', 'formhistory.sqlite', 'places.sqlite', and 'prefs.js'. These files are critical components of a Firefox profile, storing sensitive information such as encryption keys, certificates, cookies, login credentials, browsing history, and user preferences. The co-occurrence of these file names within a scanned target suggests an attempt to access, exfiltrate, or manipulate Firefox user data, often indicative of malware like credential stealers.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects recursive listing or search commands targeting OneDrive directories from a shell or script interpreter. This activity could indicate an attacker attempting to discover sensitive files within a user's OneDrive.
Correlates a downloaded remote support installer with execution of the same file on the endpoint shortly afterwards. This rule identifies instances where a known remote access tool installer (e.g., AnyDesk, Bomgar, BeyondTrust) is downloaded and then executed on the same device within a 15-minute window, which could indicate an attacker establishing remote access.
Detects when collaboration applications (like Microsoft Teams or Zoom) or web browsers launch remote support utilities. This activity may indicate social engineering tactics during a screen sharing session, where an attacker convinces a user to install or run remote access software.
Detects the use of 'sshpass' to supply a password to SSH while simultaneously disabling strict host key checking. This combination is often indicative of automated lateral movement or credential stuffing attempts where an attacker is trying to bypass host key verification to connect to multiple systems without manual intervention.
This rule looks for sensitive-looking values appearing in a publicly visible Claude workflow summary on GitHub. Public summaries can be indexed and copied quickly. Revoke any exposed credentials and restrict summary visibility. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 29 of 98