Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
Detects Python processes attempting to decrypt browser credential databases using DPAPI or CryptUnprotectData. This behavior is characteristic of malware like InvisibleFerret, which targets stored browser credentials.
Detects Python loading a .pyd or .so extension from common user-controlled or temporary directories (AppData, Temp, Downloads, Projects, /tmp/, /home/.../Downloads/) rather than a trusted package installation. This behavior is indicative of the InvisibleFerret malware, which uses Cython extensions for its operations.
Detects Python searching local vaults and configuration for password managers such as KeePass, 1Password, Bitwarden, or LastPass. This activity is associated with the InvisibleFerret malware.
Detects a loader command or memory-scanning utility referencing the Policy.dllcppage.dll marker that ZiChatBot replaces with its terminate.dll path. This rule specifically looks for process command lines containing both 'Policy.dllcppage.dll' and 'terminate.dll' executed by processes with filenames like python, rundll32, vcpktsvr, or loader.
Detects the Python wrapper and native dropper deleting their own unicode.py and terminate.dll components after the payload has been unpacked. The rule specifically looks for file deletion events where the target file name matches 'unicode.py' or 'terminate.dll' within common application data directories (site-packages, dist-packages, AppData, Temp) and the command line contains deletion-related keywords.
Detects a hidden PowerShell stage creating a process through Start-Process, WMI, reflection, or .NET process APIs. This rule specifically looks for executable files spawned by PowerShell processes where the PowerShell command line contains keywords indicative of process creation methods like 'Start-Process', 'ProcessStartInfo', 'Win32_Process', 'CreateProcess', or 'Invoke-Expression'.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects a proxy process constructing forwarder-client identifiers and asynchronous queues for bidirectional web socket tunnelling, indicative of WormSocket or similar malware activity.
Page 41 of 98