Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Flags Sysmon DNS query events (EID 22) for several weak DGA / DNS-tunnel style heuristics: very long first label, many dot-separated labels, a long alphanumeric prefix (encoded-chunk style), or a suffix on budget/phishing-heavy gTLDs and alternate naming TLDs. Noisy by design — align thresholds with Suricata custom rules in suricata/custom/detecton-lab-dns-dga-hints.rules. Does not replace resolver analytics, ET DNS rules, or ML DGA classifiers.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
Detects CrystalX-style browser clipper behavior when specific command-line patterns (CDP or clipper commands) appear in conjunction with a CrystalX temporary payload lineage. The temporary payload is identified by an executable named 'svc' followed by 3 to 6 digits, located in the user's AppData\Local\Temp directory.
This detection helps you spot activity linked to Pawn Storm PRISMEX (CVE-2026-21509 / CVE-2026-21513) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident notes and.
This detection helps you spot activity linked to TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident.
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
Page 59 of 98