Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule links downloading a Windows installer from a public GitHub repo with a Deno remote-access chain starting afterward. Trojanised releases abuse trust in open source. Only install signed builds from official vendors. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule looks for signs that someone is abusing an older Check Point VPN login method that has known security flaws. Successful abuse can give remote access without proper credentials. Patch and monitor VPN gateways if this appears. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
Detects Python accessing desktop authenticator, token, OTP, or MFA application databases and configuration. This rule specifically looks for Python processes executing with command-line arguments that indicate an attempt to interact with sensitive authenticator application data.
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects PowerShell launched with hidden or non-interactive options and encoded, compressed, or character-reassembled content. This behavior is often indicative of malicious activity, as adversaries use these techniques to evade detection and obscure their commands.
Detects a non-browser process searching for Chromium Login Data, Cookies, Local State, or Firefox logins and key databases. This activity is indicative of credential access attempts where an attacker tries to extract sensitive information stored by web browsers.
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Page 49 of 98