Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects repeated crashes and restarts of the SolarWinds Serv-U application, indicated by specific event log entries from 'Service Control Manager' or 'Application Error' sources. This pattern is consistent with known exploitation attempts targeting Serv-U.
Detects outbound network connections initiated by 7-Zip processes. This could indicate compromise of the 7-Zip application, potentially through exploitation of vulnerabilities like CVE-2026-48095, leading to data exfiltration or command and control communication.
Detects suspicious child processes spawned by 7-Zip components, which could indicate exploitation of a vulnerability (e.g., CVE-2026-48095) or other malicious activity. The rule specifically looks for common scripting and command-line interpreters being launched by 7-Zip executables.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
This rule detects suspicious execution of AADConnect synchronization processes (ADSync.exe or Microsoft.Azure.AD.Sync.exe) that are not initiated by the services.exe parent process or do not contain 'scheduled' in their command line. This pattern could indicate an attacker attempting to manipulate or leverage AADConnect for privilege escalation or lateral movement between on-premises and cloud environments, as observed in Silk Typhoon activity.
Auto-Color is a Linux backdoor that installs a malicious library libcext.so.2 and writes it to /etc/ld.preload so the library loads before all other executables. This allows the malware to hook libc functions and hide its C2 connections. This rule looks for modifications to ld.preload or the presence of libcext.so.2 in the library path. In plain terms, it catches when a backdoor is trying to make itself invisible by loading first and controlling what the system reports.
Detects ServiceAccount-based enumeration of sensitive Kubernetes resources. This rule identifies when a Kubernetes ServiceAccount performs a high volume of 'get', 'list', or 'watch' operations on sensitive resources such as secrets, pods, nodes, namespaces, or other role-related resources. It specifically flags activity with 'secrets' as high severity.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects VSLauncher.exe execution or image loading involving input.dll under SysWOW64, indicative of DLL side-loading by the UAC-0184 threat actor.
This query identifies devices and users where the compromised Nx Console VS Code extension version 18.95.0 was observed in the local VS Code extensions directory or referenced in process command-line activity. The detection focuses only on the affected version: nrwl.angular-console-18.95.0. This query combines two evidence sources: DeviceFileEvents (confirms file or folder activity related to the extension path) and DeviceProcessEvents (confirms execution or command-line reference involving the extension).
Page 57 of 98