Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
This rule detects when a process other than Firefox itself attempts to access critical Firefox profile artifacts such as key4.db, cert9.db, logins.json, cookies.sqlite, places.sqlite, formhistory.sqlite, and prefs.js. This activity is highly suspicious as these files contain sensitive user data including credentials, browsing history, and preferences, and are typically targeted by malware for data exfiltration or credential theft. The rule leverages causality fields for investigation into the actor and the causal process.
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
Token and tick payload URL structure
Cortex XDR
This rule detects network connections where the URL or remote IP address matches a specific pattern indicative of short-lived downloader URLs. These URLs typically contain paired tokens, numeric ticks, and a signature timestamp, often associated with malware distribution ecosystems. The rule leverages XQL to retain actor and causality fields for further investigation.
This rule detects the execution of temporary executables (from common temporary directories like 'temp' or 'appdata\local\temp') that are launched with a command line containing a numeric argument followed by a long Base64-like token. This pattern is often indicative of malware loaders or droppers attempting to evade detection by using obfuscated arguments.
This rule detects the presence of Remcos RAT by looking for specific strings in memory or files. It identifies a complex PowerShell command used for downloading and executing a base64-encoded payload, which is characteristic of Remcos RAT's infection chain. Additionally, it looks for specific file paths and other PowerShell-related strings often associated with Remcos RAT activity.
This rule detects the execution of Windows system utilities (rundll32.exe, regsvr32.exe, msiexec.exe) with command-line arguments that suggest the loading of DLLs, CPLs, or MSIs, often associated with HR-themed lures (e.g., payroll, tax, resume) and originating from the Downloads folder. This behavior is indicative of a DLL loader being launched, potentially from a malicious archive.
Detects Java or WebLogic processes spawning command interpreters on an application server, which may indicate successful remote code execution.
Detects a remote access utility spawning command shells or script interpreters, indicating hands-on-keyboard activity through an RMM session.
Page 53 of 98