Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a single host serving materially different status codes, body sizes, or redirects to automated user agents (bots, crawlers, scanners, curl, wget, headless browsers, python, go-http) compared to normal browsers. This behavior can indicate an Adversary-in-the-Middle (AiTM) attack where the adversary is attempting to serve different content to different user agents to evade detection or deliver malicious payloads.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects a browser-downloaded installer spawning ScreenConnect or another remote management client without an established software deployment parent. This rule identifies suspicious process creation where a known installer executable, likely downloaded from a browser (indicated by paths like Downloads, Temp, or AppData), initiates a remote monitoring and management (RMM) tool such as ScreenConnect or ConnectWiseControl. This behavior can indicate an adversary establishing remote access.
This rule looks for programs with AI-themed names (e.g., chatgpt, copilot, claude) attempting to access browser credential stores, specifically targeting login data and cookies. This activity is a common step for attackers aiming to hijack user accounts. Alerts generated by this rule should prompt an investigation into the legitimacy of the initiating process. Users should be queried about recent software installations or clicked links, and security teams should be involved if the legitimacy remains unclear.
Detects Python or a Cython module opening Chromium Login Data and Local State files outside browser execution. This activity is indicative of credential theft, specifically targeting web browser stored credentials.
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
Webworm Executes Nuclei and dirsearch
Cortex XDR
Detects vulnerability and directory scanners (Nuclei, dirsearch, or Python scripts) launched with output files or target lists covering numerous web servers. This activity is associated with the Webworm threat group.
Detects a ScreenConnect client launched with several repeated c= custom fields, which can carry attacker configuration and campaign metadata. This behavior has been observed in cryptojacking campaigns abusing ScreenConnect.
Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.
Detects a single host making Zulip REST API POST requests to multiple distinct topics, specifically looking for patterns associated with system profiling and command/tasking as observed in ZiChatBot. The rule identifies activity where a source IP uses the Zulip API to send messages to at least two different topics, with the raw request content indicating either 'channel/stream' and 'topic/subject' or keywords like 'system info', 'shellcode', 'task', or 'command'.
Page 5 of 98