Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Detects a loader writing an encrypted data component and immediately querying hostname, processor, or volume identifiers used to derive a machine-specific decryption key. This behavior is indicative of malware, such as RokRAT, attempting to create a system-specific payload to evade detection or ensure persistence.
Detects a small Go-based scanner, identified by its renamed executable 'go.exe', when launched with command-line arguments indicative of broad network scanning activities such as CIDR range specifications (/16, /24), service discovery, or exploit module usage. This behavior is often associated with initial access or reconnaissance phases by adversaries.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
Page 32 of 98