Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects commands querying video controller names, memory, or GPU vendor information, commonly used by adversaries to select a compatible mining payload for cryptojacking campaigns.
Detects a recently downloaded utility executable loading autorun.dll from the same writable directory, consistent with DLL side-loading. This behavior is often associated with malware attempting to establish persistence or elevate privileges by abusing legitimate applications.
Detects a mining process launched with a stratum endpoint, wallet address, worker name, or GPU algorithm arguments. This rule identifies common cryptocurrency mining software (xmrig, lolminer, phoenixminer, nbminer, minerd, miner) when executed with command-line parameters indicative of connecting to a mining pool or specifying wallet/algorithm details.
Detects a script or small watchdog process repeatedly launching the same miner on one device within a short period. This behavior is indicative of cryptojacking activity where a persistent mechanism ensures the cryptocurrency miner continues to run even if terminated.
Detects a CPU miner configured with an unusually high thread count or affinity mask after GPU capability checks. This behavior is indicative of cryptojacking activity where an attacker is attempting to maximize CPU resource utilization for cryptocurrency mining.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
Detects execution or file activity involving SHA-256 hashes attributed to analyzed VVS Discord Stealer samples. This rule provides high-confidence indicator coverage and should be retained as supporting intelligence alongside the behavioral detections in this pack.
This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.
Page 44 of 98