Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects the campaign-specific REDCAP-TOKEN cookie name in available endpoint or network event metadata. GTIG reported that INFINITERED used this HTTP cookie to receive encrypted commands and return system, database, and configuration information. This query depends on the cookie value being retained in AdditionalFields by the available sensor or integrated telemetry source.
This rule finds an npm package whose main index.js file was swapped for a much larger obfuscated version. Maintainers may not notice a silent replace during a compromise. Compare package hashes to known good releases. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects management log entries in Cisco SD-WAN that indicate a potentially malicious file path being used during a CSV upload. Such crafted uploads have been exploited in real-world attacks to execute commands on network appliances. Detection of this activity suggests a compromise attempt or successful exploitation. It is recommended to block and audit the source account, investigate the user's recent activities (e.g., new software installations, clicked links), and involve the security team for further analysis.
This rule detects attempts by package management processes (like npm or bun) to invoke the GitHub CLI (gh.exe) with commands that could be used to steal session tokens. This activity is suspicious as it suggests a potential supply-chain compromise targeting developer machines, where maintainers are high-value targets. The rule specifically looks for 'gh.exe' or 'gh' being executed with 'auth' and 'token' in the command line, initiated by 'node.exe', 'bun.exe', or 'npm.cmd'.
This rule detects the execution of scripting interpreters (PowerShell, WScript, CScript, MSHTA, CMD) where the initiating process's command line contains keywords related to FIFA or World Cup, suggesting a potential phishing attempt using a themed attachment. The rule aims to identify initial access attempts where users are lured into opening malicious files disguised as legitimate content (e.g., tickets, schedules, streaming links for a major sporting event).
This rule detects process command lines that indicate an attempt to execute a one-line install command from a GitHub raw content URL, often associated with untrusted or malicious projects. It specifically looks for common command-line tools used for downloading and executing scripts (like iex, Invoke-WebRequest, curl, wget, msiexec, Start-Process) in conjunction with keywords suggesting fake software or plugins (e.g., ChatGPT, Claude, AutoTune, Kontakt, plugin, installer).
This rule searches CI logs and commands for patterns that extract GitHub secret values where isSecret is true. Automated secret scraping in pipelines leads to repository takeover. Audit workflow YAML changes. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule looks for a package writing a short-lived JavaScript file with a p-prefix name in temp during install. That pattern matches known stealers and wipers. Quarantine the package version. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule flags a notarised macOS Flutter application whose web view can trigger command execution. Apple notarisation does not guarantee good intent. Investigate any unfamiliar app with this pattern. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule catches a preinstall script running an obfuscated index.js before the main install completes. Preinstall runs automatically without user consent. Never ignore preinstall additions in dependency updates. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 54 of 98