Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects PowerShell commands executed by a Node.js process to gather system information, specifically targeting installed applications and packages. This could indicate malicious activity where a Node.js application or script is being used to enumerate system details.
Detects rapid enumeration of SharePoint sites, drives, lists, and document libraries from one account, which can precede targeted data collection. This rule identifies a high volume of GET requests to SharePoint-related URIs within a short timeframe, indicating potential reconnaissance or data exfiltration attempts.
This rule detects a specific command-line pattern executed via `cmd.exe` that is associated with the ClickFix attack. The pattern involves moving an `update.zip` file from the user's downloads directory, extracting a `u.zip` file in the temporary directory using `tar`, and then executing an `update.bat` script. This sequence of actions is indicative of a multi-stage malicious payload deployment.
This rule detects the creation of Electron application runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual or suspicious AppData\Local subdirectories. This behavior is associated with the Ghost ClickFix attack chain, where compromised systems are used to deploy malicious Electron applications. The rule specifically looks for file creations in paths matching `\appdata\local\(super|max|util)[^\\]*` and installer executables named `utilifysetup.exe`, `setup.exe`, or `is-[a-z0-9]+\.exe`.
This rule detects executable files being created or launched within the 'AppData\Local\Programs' directory by a temporary-stage process. This behavior is often indicative of malware attempting to establish persistence or execute from a user-specific location, leveraging temporary directories for initial execution or staging.
AD Snapshot Is Compressed with 7zr
Cortex XDR
Detects the use of 7-Zip (7zr.exe) to compress Active Directory snapshot files (result.dat or snapshot) into an archive with a specific compression level (-mx=5). This activity could indicate an adversary staging data for exfiltration.
AD Explorer Creates a Directory Snapshot
Cortex XDR
Detects AD Explorer running with the snapshot option and writing result.dat into a temporary directory. This activity is often associated with reconnaissance and credential dumping in Active Directory environments.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Page 6 of 98