Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands for registry queries, installed application enumeration, and process listing.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a suspicious C2 domain (hellolargeworld.com) or invocation method (Extension.SubRoutine.Run2).
Detects instances where 'node.exe' accesses browser extension LevelDB directories for Chrome, Edge, or Brave, or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior can indicate attempts to exfiltrate sensitive browser data or establish persistence, potentially associated with supply chain attacks or backdoors.
Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.
Detects instances where 'node.exe' or 'node' initiates the deletion of 'setup.cjs' from the 'node_modules/easy-day-js' directory. This includes both direct file system deletion (fs.rmSync) and shell-based deletion commands (e.g., 'del /f', 'rm -f') executed by 'node.exe'. This activity is indicative of potential malicious behavior, possibly related to supply chain attacks or post-exploitation cleanup.
Detects the deletion of PowerShell console history files (ConsoleHost_history.txt) within the PSReadLine folder. This activity can be indicative of an attacker attempting to remove forensic evidence of their commands, often seen in post-exploitation phases to hinder incident response and hide malicious activities.
Detects the use of reg.exe to add persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for the addition of 'NvmProtocal', 'protocal.cjs', or 'NodePackages' which are associated with a backdoor.
This rule detects network communication to a known command and control (C2) server (23.254.164.123:443) associated with the 'protocal.cjs' backdoor, which is part of the 'easy-day-js' npm supply chain compromise. The detection specifically looks for TLS traffic with a Server Name Indication (SNI) and general IP traffic to this C2 address.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
Page 3 of 98