Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the staging of remote management tools (AnyDesk, RustDesk, ScreenConnect, TeamViewer) on a device, where the initiating process's command line contains keywords related to business lures (invoice, payroll, tax, HR, resume, quotation). This pattern is indicative of TA4922 activity, where attackers use business-themed social engineering to gain initial access and then deploy RMM tools for persistent access before deploying ransomware.
This rule correlates successful VPN authentication events with the subsequent execution of tools commonly associated with ransomware staging activities within a 6-hour window. It aims to detect initial access via VPN followed by preparatory actions for ransomware deployment. The rule specifically looks for VPN logins from 'Check Point' devices and process executions of 'rclone.exe', '7z.exe', 'powershell.exe', 'wevtutil.exe', 'vssadmin.exe', or 'nltest.exe'.
This rule detects a burst of network discovery activity from tools linked to DIY ransomware kits advertised with AI themes. Attackers use these tools to identify machines before encrypting files. Fast, repeated discovery from a single source is a serious warning sign. The rule specifically looks for multiple distinct discovery tools (nltest.exe, net.exe, net1.exe, dsquery.exe, adfind.exe, whoami.exe, ipconfig.exe) executed from common user-writable or temporary directories within a short timeframe.
This rule looks for command-line text associated with Atlas remote-access malware checking in to its controller. That check-in means the machine may already be under outsider control. Isolate the host and begin incident response if confirmed. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects files commonly associated with endpoint detection and response (EDR) evasion techniques being staged within 'test' subfolders under a user's 'Documents' directory. The presence of such files (executables, DLLs, PowerShell scripts, or binaries) with names indicating 'loader', 'bypass', 'edr', 'inject', 'payload', 'agent', or 'defender' suggests an attacker is preparing to deploy or test EDR evasion tools on the workstation. This activity could precede a larger attack.
This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.
This rule detects the creation of files in the Windows Fonts directory that have specific prefixes (X1, KX1, or KW1) followed by at least three alphanumeric characters, underscores, hyphens, or periods. This pattern is indicative of potential malicious activity, such as the deployment of container files or extensionless executables by malware like SprySocks, which may attempt to hide within system directories.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects the creation of executable files (.exe) by common archive utilities such as 7-Zip, WinRAR, tar, or PowerShell. It specifically targets scenarios where these utilities are used to extract or create executables, which can be indicative of malware unpacking or staging. The rule focuses on the process responsible for the file creation and the type of file being created, aiming to identify potentially malicious activity involving compressed or archived executables.
Targets an unusually large executable produced by 7-Zip, WinRAR, tar, or PowerShell extraction. The UDM rule retains principal and target context for correlation.
Page 51 of 98