Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule looks for fake reverse-engineering or debugging tools installing clipboard monitors that swap cryptocurrency addresses. Developers are targeted because they handle valuable assets. Use official vendor downloads only. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule alerts when edge router settings change outside an approved maintenance window. Surprise config changes can redirect traffic or weaken security controls. Confirm change tickets and the engineer responsible. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the installation of Deno via Windows Package Manager (winget.exe) when initiated by common scripting or installer processes (powershell.exe, cmd.exe, msiexec.exe). This activity is indicative of a potential attack where a fake application might have been executed, leading to the quiet setup of Deno, which can then be used as a Remote Access Trojan (RAT). The rule specifically looks for 'winget.exe' executing with 'install' and 'Deno' in its command line, initiated by the specified processes.
This rule flags a large number of files receiving a '.lalia' extension at once, indicating potential Lalia ransomware activity. Bulk extension changes are a common initial indicator of ransomware infection. The rule looks for at least 20 file events (renamed, created, or modified) where the file name ends with '.lalia' within a 30-day window.
This rule watches for creation of ransom notes associated with the Lalia family. Notes often appear in multiple folders once encryption finishes. Identify patient zero and check offline backups. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This YARA rule detects Compiled HTML Help (CHM) files based on specific internal strings related to their structure and compilation. The rule identifies CHM files that contain internal data space and compression references, as well as specific compiler signatures such as "Free Pascal's chm package 3.0.4", "CHMCmd 3.0.4", and "HHA Version 4.74.8702". While the rule's name suggests detection of JavaScript execution via PowerShell within CHM files, the current string-based logic primarily focuses on the file's internal characteristics and compiler metadata, which can be indicative of potentially malicious CHM files used in attack campaigns.
This rule looks for a Rust-based stealer that uses Tor for hiding traffic and low-level Linux hooks associated with IronWorm. This malware targets developers through poisoned packages. Linux build servers are at special risk. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule looks for a non-interactive shell process reading npmrc token files outside normal developer activity. Automated readers often belong to stealers. Rotate npm tokens and check publish history. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule links changes that weaken Windows Defender with a rapid series of network discovery commands. Attackers often turn down protections before mapping the network for ransomware. Treat this sequence as active compromise. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects installers masquerading as legitimate security or analysis utilities (e.g., Ghidra, dnSpy, Wireshark) that subsequently launch common loader programs (e.g., PowerShell, rundll32, cmd.exe). Such activity often indicates an attempt to bypass user suspicion and deliver malware. It is crucial to verify publisher signatures and the origin of downloaded software. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
Page 56 of 98