Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable. This rule specifically looks for process creation events where the executable name is 'obs-check-update' and the file path is within '/tmp/obsHub/' or '/var/tmp/obsHub/'.
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
Detects PowerShell using the Add-Type cmdlet to dynamically compile C# code referencing keylogging (SetWindowsHookEx) or screen capture (CopyFromScreen) APIs. This behavior is indicative of PS1Bot in-memory module execution.
This rule spots signed fake AI software that launches trusted Windows utilities in unusual ways to hide malicious activity. Attackers abuse built-in tools so security software trusts the chain. Examine the parent installer and child commands. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the creation of a new GitHub repository from a compromised endpoint, specifically looking for indicators of stolen credential exfiltration. The rule identifies GitHub application events where a repository is created and the raw event data contains keywords associated with credential dumping or specific campaign names like "Miasma" or "Spreading Blight". Automated exfiltration to GitHub is often fast and difficult to remediate, making prompt detection crucial. If triggered, it's recommended to revoke tokens used to create the repository and investigate the endpoint for compromise.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Detects attempts by Electron or Node.js applications to establish persistence by creating or modifying Run or RunOnce registry keys. The rule specifically looks for applications located within the AppData\Local directory, which is a common technique for malware or unwanted applications to maintain execution across system reboots. This rule leverages UDM for principal and target context to aid in correlation.
Detects the loading of 'tpsvcloc.dll' from the 'Windows Fonts' directory by a ThinPrint-related signed host. This behavior is indicative of potential DLL side-loading or hijacking, as 'tpsvcloc.dll' is typically associated with ThinPrint software and should not be loaded from the Fonts directory. The rule focuses on identifying this specific anomalous module load event.
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
This rule detects the creation of files in the Windows Fonts directory that have specific prefixes (X1, KX1, or KW1) followed by at least three alphanumeric characters, underscores, hyphens, or periods. This pattern is indicative of potential malicious activity, such as the deployment of container files or extensionless executables by malware like SprySocks, which may attempt to hide within system directories.
Page 37 of 98