Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule looks for sensitive-looking values appearing in a publicly visible Claude workflow summary on GitHub. Public summaries can be indexed and copied quickly. Revoke any exposed credentials and restrict summary visibility. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects the creation of both 'UpdateSystem' and 'UpdateUser' scheduled tasks on the same device within a ten-minute window, a distinctive persistence pattern associated with the Gentlemen Ransomware.
This rule detects the execution of 'envchk.exe' from common Windows temporary directories (e.g., C:\Windows\Temp\ or C:\Users\<User>\AppData\Local\Temp\). It then correlates this activity with subsequent executions of system profiling commands such as 'hostname.exe', 'ipconfig.exe', 'tasklist.exe', 'wmic.exe', 'powershell.exe', or 'reg.exe' within a 5-minute window. The detection specifically looks for command-line arguments indicative of system information gathering (e.g., 'getmac', 'Win32_Product', 'Get-Package', 'Get-Culture', 'Get-DnsClient', 'tasklist', 'hostname'). This sequence of events is characteristic of the environment-check stage of the DAEMON Tools backdoor campaign, aiming to identify the system's configuration and environment.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects a component combining spooler token access and CreateProcessAsUser, often indicative of the Sprysocks malware. The rule specifically looks for the presence of 'spoolsv.exe' along with API calls 'OpenProcessToken', 'DuplicateTokenEx', and 'CreateProcessAsUser', which are used to elevate privileges or impersonate other users by duplicating a token from the print spooler service and then launching a new process with that token.
Detects vcpktsvr.exe loading a local libcef.dll associated with the non-standard cef_api_mash export used by ZiChatBot.
Detects PowerShell or .NET code modifying ServicePointManager or certificate validation callbacks so later downloads accept untrusted certificates. This behavior is often associated with malware like InstallFix to bypass security measures during C2 communication or payload delivery.
This rule detects attempts to establish persistence for 'vds.exe' (Virtual Disk Service) by modifying the Image File Execution Options (IFEO) registry key to point its debugger to an executable located within the Windows Fonts directory. This technique is often used by adversaries to maintain access or elevate privileges, as the Fonts directory is typically writable by standard users and can be used to hide malicious executables.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').
Page 30 of 98