Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
Detects a loader requesting a PHP payload with a generated host identifier and then writing a marker that prevents repeat delivery. This rule specifically looks for network connections initiated by executables like 'powershell', 'cmd', 'loader', or 'update' that include command-line arguments indicative of a PHP payload request with a unique identifier and a marker for single delivery.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
This rule detects unauthenticated POST requests with 'Content-Encoding: deflate' in the HTTP header or command line, specifically targeting a vulnerability in SolarWinds Serv-U. The rule aims to identify exploitation attempts related to CVE-2026-28318.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Detects the execution of mshta.exe with a remote .7z file as an argument. This behavior is often indicative of malicious activity where mshta is abused to execute script content disguised as an archive file from a remote source.
Detects the execution of mshta.exe with a remote .7z file as an argument. This behavior is often indicative of malicious activity where mshta is abused to execute script content disguised as an archive file from a remote source.
Page 31 of 98