Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
This rule correlates the creation and subsequent removal of a driver service within a 15-minute window. It specifically looks for registry events indicating the creation and deletion of a service key, where the service's image path ends with '.sys' or the key name contains 'msidiskserver'. This behavior is indicative of the transient driver-loading workflow used by SprySOCKS malware.
Detect Tiny Vbs
YARA
This YARA rule detects Visual Basic Script (VBS) files that contain common keywords often used in malicious VBScripts. Specifically, it looks for the presence of 'Dim' (for variable declaration), 'Wscript.Shell' (to interact with the operating system shell), 'End Function' (a VBScript construct), and 'CreateObject' (to create COM objects). The rule is designed to identify potentially malicious VBS files, possibly used for execution, persistence, or other adversarial activities.
This rule detects potentially malicious PDF files that act as droppers. It looks for a valid PDF header combined with specific PDF object patterns (Catalog, Pages, Page, FlateDecode) and indicators of malicious activity. These indicators include commands to launch chrome.exe, launch actions, obfuscated JavaScript for data export, or an 'anonymous' author field, which can be used by malware families like win.cloudeye.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
Detects the creation of a scheduled task using 'schtasks' with 'SYSTEM' privileges, masquerading as Adobe or OneDrive, and pointing to an executable in a user-writable path (Temp, AppData, ProgramData, or Users\Public). This pattern is often used by adversaries for persistence or privilege escalation.
Detects patterns indicative of DPAPI key exfiltration, specifically looking for the strings 'Local State', 'CryptUnprotectData', '/Key', and 'access_token' within a file or process memory. This combination suggests an attempt to decrypt and exfiltrate credentials or tokens.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
Detects installation of common remote management products from Downloads, Temp, AppData, Desktop, or Public user paths with silent installation options. This activity is often associated with adversaries establishing persistence or gaining remote access.
Page 34 of 98