Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a non-OneDrive process creating files, result, and job subdirectories associated with cloud-hosted tasking, indicative of GraphWorm or similar malware activity leveraging OneDrive for command and control or data staging.
Detects a game updater overwriting an established executable in the platform directory with a new binary from a temporary staging path. This behavior can be indicative of a supply chain attack where legitimate game update mechanisms are compromised to deliver malicious payloads.
Detects VSPMsg.dll written beneath the x64 print processor directory from ProgramData or another staging path. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
Detects an Image File Execution Options debugger value for vds.exe that redirects execution to an executable stored in Windows Fonts. This specific condition is often associated with the SprySOCKS component, indicating a potential malicious persistence mechanism rather than a common Windows artifact.
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
This YARA rule detects the presence of specific strings associated with security drivers and system monitoring tools (ESET, Npcap, Sysmon) within a file or memory. The detection of these strings, particularly in a cluster, suggests an environment reconnaissance activity, potentially by malware like Sessiongate, which might be checking for the presence of security software or network capture tools.
This rule detects patterns associated with the APT29 Wineloader backdoor. It looks for the creation of ActiveX objects for Wscript.Shell and Scripting.FileSystemObject, XMLHttpRequest for HTTP requests, specific `certutil -decode` commands, `tar -xf` commands, the presence of `SqlDumper.exe` in a specific path, and generic URL patterns. These indicators suggest potential execution of malicious scripts, file manipulation, data exfiltration, and command and control communication.
This rule alerts when a new format-check workflow is created matching malicious supply-chain templates. These workflows run on every push and can steal secrets. Require security review for all new workflow files. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 50 of 98