Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Udm Mail Task Masquerade
YARA-L
Targets a scheduled task with trusted vendor wording whose action points to Temp, AppData, Public, or ProgramData. The UDM rule retains principal and target context for correlation.
Targets service registration for msidiskserver or an ImagePath ending in fsdiskbit.sys. The UDM rule retains principal and target context for correlation.
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
Page 46 of 98