Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule looks for exposed pairs of credentials used for GitHub cloud identity federation in logs or artifacts. Leaked pairs let attackers mint tokens as your pipeline. Rotate federation settings and audit recent workflow runs.
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
Detects the creation or modification of directories named 'logs', 'persistantstorage', or 'scratchpad' within paths related to PeopleSoft PSEMHUB. This activity could indicate an attacker staging data or setting up persistence, as observed in campaigns like ShinyHunters targeting the education sector with Oracle exploits.
Correlates Windows 365 or Citrix client execution with network share discovery commands by the same account on the same device within thirty minutes. This rule detects potential post-compromise activity where an attacker might be using a VDI session to enumerate network shares.
Detects a single process initiating SSH connections to a large number of distinct private IP addresses within a ten-minute window. This behavior can indicate automated lateral movement, credential spraying, or other malicious network reconnaissance activities.
Detects the execution of 'netsh.exe', 'sc.exe', or 'powershell.exe' with command-line arguments indicative of enabling network discovery, file and printer sharing, or modifying firewall rules to allow inbound connections. This behavior is associated with the Gentlemen ransomware for propagation.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
This rule detects when package managers like npm, bun, or pnpm access SSH private key files. Such activity can indicate a supply chain attack where a malicious package attempts to exfiltrate sensitive credentials, granting unauthorized access to servers. If this alert fires, investigate the initiating process, check for newly installed software, and audit server logins associated with the compromised SSH key. Involve your security team if the cause is unclear.
Page 48 of 98