Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects a non-OneDrive client invoking createUploadSession after creating staged command output or archives, indicative of GraphWorm activity.
This rule detects consecutive TLS application data records with 32-byte encrypted payloads. This specific record pattern has been observed during AsyncRAT encrypted communication. The rule is port-independent and serves as a supporting indicator for AsyncRAT activity, rather than a standalone high-confidence signature.
Detects process injection telemetry targeting spoolsv.exe followed by an unusual svchost child or related launch from the same initiating process. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Detects a non-Firefox process creating staged copies of at least three NSS, login, cookie, history, or preference files from Firefox-style profiles. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects an administrative content rule that combines strategic research or defence collection terms with an external BCC, forward, or redirect destination. GTIG reported that the Patroit rule matched subjects related to medical research, Chikungunya, artificial intelligence, cyber programmes, Indo-Pacific operations, defence, and uncrewed systems before silently forwarding the messages.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
Detects REDCap-associated PHP or web server processes launching operating system command interpreters. GTIG observed INFINITERED using trojanised REDCap components and web shell functionality to execute arbitrary shell commands. This behaviour is highly unusual for normal REDCap operations and may indicate post-exploitation activity.
Page 42 of 98