Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Task Fonts Startup
YARA-L
Targets the startup task behaviour that launches a Fonts-hosted executable with SYSTEM-level persistence. The UDM rule retains principal and target context for correlation.
Udm Aspose Email Load
YARA-L
Targets Aspose.Email DLL loading by a user-writable or masquerading executable rather than an approved mail application. The UDM rule retains principal and target context for correlation.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Page 38 of 98