Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
This rule detects the loading of 'tpsvcloc.dll' from the 'Windows\Fonts' directory by a process associated with ThinPrint. This behavior is indicative of DLL sideloading, where a malicious DLL is placed in a location that a legitimate application (ThinPrint in this case) will load, allowing for arbitrary code execution. The rule specifically looks for image load events where the module name is 'tpsvcloc.dll', the module path is within 'Windows\Fonts', and the actor process image path contains 'thinprint', 'tpsvc', or 'tp*.exe'.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
Defender exclusion for the Hola path
Cortex XDR
This rule detects attempts to modify Windows Defender preferences to exclude the Hola application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun that include 'add-mppreference', 'exclusion', and 'hola' keywords, indicating an attempt to bypass antivirus scanning for the Hola application.
This rule detects the creation of specific files (lgf.dat or lg.dat) within a user's Microsoft Vault directory, which are indicative of keylogger activity. The rule leverages Cortex XDR data to provide causality and actor information for investigation.
This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.
This YARA rule detects the presence of various PowerShell commands and functions that are commonly used in malicious scripts. It looks for a combination of specific cmdlets like 'New-Object', 'Invoke-WebRequest', 'Invoke-Expression', 'Set-ExecutionPolicy Bypass', and 'Add-Type', as well as patterns for functions that might be used for obfuscation or specific malicious activities (e.g., 'vS35wIDY9U', 'wEAXbwCuxi'). The rule triggers if at least three of the defined strings or regular expressions are found, indicating potential PowerShell-based malicious activity.
This rule looks for adding a passwordless sudo rule for a CI runner account on Linux. Attackers who gain runner access can then become root freely. Remove the rule and audit runner images. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 47 of 98