Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
Detects a new mailbox rule that deletes, moves, redirects, or marks as read messages containing security, sign-in, MFA, alert, or administrator terms. This behavior is often indicative of an adversary attempting to hide their activities or prevent detection by preventing security notifications from reaching the user.
Detects a persistent module loading a previously unseen DLL from its task or plug-in directory after local IPC activity. This behavior is associated with the Kazuar malware.
Detects repeated creation attempts for the same mutex, pipe, lock file, or loopback endpoint by several module processes, leaving one active leader. This behavior is indicative of the Kazuar malware establishing a leader election mechanism to coordinate its activities on a compromised system.
Detects a module enumerating local processes, named pipes, loopback listeners, mutexes, or shared-memory sections to locate bot peers, indicative of Kazuar malware activity.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
Detects a 'bridge', 'kernel', 'service', or 'host' process repeatedly starting a 'worker', 'plugin', or 'module' process after short runtimes, indicating watchdog and resilience logic. This behavior is associated with the Kazuar malware.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Page 35 of 98