Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects suspicious Kubernetes Role-Based Access Control (RBAC) changes that grant elevated privileges, such as 'cluster-admin' roles, wildcard permissions for verbs, resources, or API groups, or direct access to secrets or service accounts. This rule monitors 'create', 'update', and 'patch' operations on roles, clusterroles, rolebindings, and clusterrolebindings within Kubernetes audit logs.
This rule detects a common worm behavior where 'explorer.exe' spawns 'cmd.exe' with both 'start' and 'exit' commands in the command line. This pattern is often used by worms like Phorpiex and Ippedo to launch a payload and then immediately close the shell, potentially to evade detection. The rule specifically looks for 'explorer.exe' as the parent process of 'cmd.exe' and requires both 'start' and 'exit' keywords in the 'cmd.exe' command line. It filters out legitimate uses involving 'msiexec', 'installutil', 'dotnet', 'npm', or 'node' in the command line.
Detects Plane9 or Cluster-Overlay style execution from AppData or other user-writable staging paths, which is indicative of malware associated with the UAC-0184 threat actor.
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
The Storm-0408 malvertising campaign uses RegAsm.exe from the .NET Framework as a living-off-the-land binary for command and control. After the initial dropper from GitHub establishes a foothold, the malware injects code into RegAsm.exe to connect to C2 over TCP ports 15647 or 9000, exfiltrate data, and access DPAPI. This rule looks for RegAsm.exe launched from a temp or user writable path, which is unusual because the legitimate RegAsm is typically in the .NET Framework directory. In plain terms, it catches when a normal-looking system tool is being used from the wrong place to talk to an attacker.
This rule detects the execution of 'OneDriveStandaloneUpdater.exe' with the '-Embedding' command-line argument, specifically when it is not launched by legitimate parent processes like 'OneDrive.exe', 'svchost.exe', or 'SearchHost.exe'. This behavior is indicative of potential DLL sideloading, a technique used by malware such as Black Basta's BackConnect, where the updater is launched post-exploitation from an unusual location (e.g., AppData) to load malicious DLLs. The rule aims to identify suspicious instances of this updater being used as a staged malware component rather than for legitimate OneDrive updates.
This rule detects the execution of 'findstr.exe' with command-line arguments that include common strings associated with antivirus software processes or services. This activity is often performed by malware, specifically observed in Storm-0408 malvertising campaigns, to discover installed security products before attempting evasion. The rule filters out instances where 'msiexec.exe' is the parent process, as this can indicate legitimate software inventory scripts.
Detects workloads created with privileged mode, host namespace sharing, dangerous Linux capabilities, Docker socket, containerd socket, or sensitive hostPath mounts. These configurations can be abused by adversaries to escape containers and gain access to the underlying host.
This rule detects the creation or modification of registry keys under 'HKCU\SOFTWARE\TitanPlus' or 'HKLM\SOFTWARE\TitanPlus' that contain specific IP addresses (38.180.25, 45.8.157, or 5.181.3) in their details. This activity is associated with Black Basta and Cactus ransomware for storing BackConnect C2 IP addresses.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
Page 58 of 98