Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
This rule detects unauthenticated POST requests to Serv-U that utilize 'deflate' content encoding, as described in a vendor advisory. It aims to identify exploitation attempts related to CVE-2026-28318 by filtering network events for specific HTTP POST request patterns. The XQL view retains actor and causality fields to aid in investigation.
LdrCallEnclave shellcode execution
Cortex XDR
This rule detects the use of LdrCallEnclave, a function often associated with shellcode execution, when initiated by Python or an executable located in a user-writable temporary directory (e.g., Temp, AppData, ProgramData). The detection focuses on processes whose image name matches 'python', 'python3', or any executable name followed by '.exe', and whose path contains common temporary or user-writable directories. The rule specifically looks for 'ldrcallenclave' in the command line arguments, indicating potential malicious activity such as process injection or shellcode execution.
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (AppData\Roaming\Microsoft\Windows). This activity is suspicious as Notepad++ DLLs are not typically found in this location and could indicate an attempt at DLL side-loading or other forms of execution hijacking.
RawWNPF rootkit device artefact
Cortex XDR
This rule detects the presence of the RawWNPF rootkit by searching for references to '\device\rawwnpf' or 'rawwnpf' in process command lines. It focuses on process events and provides causality fields for investigation.
This rule detects the creation of a Run key or login persistence entry by an Electron or Node.js process, where the persistent application is located within the AppData\Local directory. It specifically looks for registry modifications that establish persistence for executables in user-specific application data folders, often indicative of malware or unwanted applications.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
This rule detects attempts at path traversal within JRPC (JSON-RPC or RPC) requests targeting FortiSandbox, including plain, encoded, double-encoded, and mixed-separator path traversal patterns. It focuses on network events and provides causality fields for investigation.
This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Page 39 of 98