Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.
This rule detects a multi-step execution chain where Node.js (or npm) spawns a shell process, which then launches Bun. This pattern has been observed in malicious packages to hide the final payload from simple scanners. It is crucial to review the full parent-child process tree for any alerts. Users should be questioned about recent software installations or clicked links, and security teams should be involved if the activity is suspicious.
This rule detects misconfigurations in GitHub Actions workflows related to Claude automation. Specifically, it looks for workflow files (.yml or .yaml) within the '.github/workflows' directory where the initiating process command line contains 'allowed_non_write_users' or 'claude-code-action' along with a wildcard ('*') in the user permissions. Such a configuration could allow unauthorized users to trigger code changes via AI actions on a repository, indicating a potential security vulnerability.
This rule finds Bun extracted to a temporary folder during npm install on a machine that does not normally use Bun. Temp paths hide binaries from casual inspection. Remove the package and scan the host. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects a newly launched module creating a hidden or randomly named working directory used to stage configuration, tasks, and output. The rule specifically looks for file creation events (EventCode=11) in common application data directories (appdata, programdata, temp) where the filename matches a pattern indicative of a hidden or randomly named directory followed by specific subdirectories like 'config', 'tasks', 'jobs', 'output', or 'cache'.
Detects inbound emails that are fully authenticated (SPF, DKIM, DMARC pass) and contain keywords related to 'code of conduct', 'employee handbook', 'policy acknowledgement', or 'compliance update' in the subject line, originating from a sender domain that has not been observed by the recipient organization within the last 24 hours. This rule aims to identify potential phishing attempts leveraging social engineering themes from newly registered or previously unseen domains.
Detects a dropper deriving a decryption key from hostname or machine attributes before unpacking a second-stage module. The rule specifically looks for process command lines containing keywords related to hostname/computername/machineguid/volume serial combined with decryption-related terms like decrypt, aes, xor, payload, or byte array.
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Page 43 of 98