Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
This rule flags FIFA-related phishing emails from senders your organisation has never received mail from before. New senders plus urgent sports language is a common fraud pattern. Use multi-factor authentication on mail-linked accounts. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects a suspicious chain of events starting from a web browser (Chrome, Edge, or Firefox) initiating a process like PowerShell, Cmd, Msiexec, or Rundll32. The detection is further narrowed down by looking for specific command-line arguments related to downloads or temporary directories, and crucially, by identifying that the executed payload is unsigned or has an untrusted signature. This pattern is indicative of malvertising leading to the execution of potentially malicious, unsigned software.
The rule detects the use of Mimikatz by searching for specific keywords within Windows event logs. These keywords include Mimikatz module commands (e.g., 'dpapi::masterkey', 'kerberos::golden', 'lsadump::', 'sekurlsa::'), artifacts associated with Mimikatz (e.g., 'mimidrv.sys', 'mimilib.dll'), and PowerShell commands commonly used with Mimikatz (e.g., 'Invoke-Mimikatz', 'Invoke-Mimikittenz'). The detection logic specifically excludes events with EventID 15.
This rule flags many npm republications from an account soon after suspicious token activity. Stolen maintainer tokens cause rapid malicious releases. Lock the account and audit download stats. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule spots fake AI installers that immediately launch hidden scripts on a Windows computer. Attackers dress up malware as popular AI tools so victims click without thinking. The alert means a suspicious install may be trying to run commands in the background. If this was not expected, treat it as a possible scam or break-in.
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects scripts abusing the tenant list upload feature on Cisco SD-WAN managers. Such misuse can expose customer networks or implant changes at scale. It is crucial to review who ran the script and what file was uploaded. If this alert fires, investigate the user's recent activities, specifically if they installed new software or clicked any suspicious links. Involve your security team if the situation remains unclear.
This rule detects the Deno runtime accessing sensitive browser profile data (Login Data, Cookies, Local State) and cryptocurrency wallet directories (Wallet, Electrum, Exodus, MetaMask) on the same machine. This dual access pattern is indicative of infostealer malware, often distributed as fake coding utilities. End-user PCs should rarely run Deno, making such activity highly suspicious.
This rule watches for AI-named programs run straight from the Downloads folder or temporary directories after a web download. Many fake AI scams start exactly this way. If the program then does anything unusual, it may be malware posing as a free AI tool. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 55 of 98