Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This detection rule identifies network activity associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains and specific URL paths used by the malware for authentication, data upload, or core functionality. The rule leverages network proxy, firewall, or Zeek HTTP logs to extract and analyze URLs. A match indicates a strong reason to investigate the affected host and user, check for expected access, and review nearby activity for further compromise.
Detects network communication patterns associated with EtherRAT, including beaconing to 'aurineuroth.com' and CDN-like URLs. Additionally, it identifies host-based fingerprinting activities often performed by EtherRAT, such as hidden PowerShell execution, discovery of MachineGuid, antivirus product information, domain membership, and video controller details, as well as the creation of 'svchost.log' in AppData.
This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.
This detection rule identifies activities related to the TeamPCP Trivy supply chain compromise (CVE-2026-33634). It looks for specific indicators such as the presence of 'tpcp.tar.gz' in command lines, connections to the exfiltration domain 'scan.aquasecurtiy.org', access to '/proc/[pid]/mem' via command line, or the execution of 'sysmon.py' or 'systemctl' in suspicious contexts. A match indicates a strong reason for investigation, particularly in CI runner or developer environments, to confirm compromise and review follow-on activities.
This rule detects activities associated with the 'CTRL' Russian .Net access framework. It looks for a combination of a hidden PowerShell stager, UAC bypass attempts via registry modification (ms-settings), and the launch of fodhelper.exe. Additionally, it requires the presence of at least one of the following: disguised registry payload storage, FRP configuration file staging, keylogger artifact creation, named pipe creation ('ctrlPipe'), RDP tampering artifacts, or PowerShell commands related to Windows Defender exclusion changes.
This detection rule identifies network traffic associated with the Powercat malware campaign by looking for specific URL patterns or domains mentioned in threat intelligence. It focuses on high-confidence indicators such as 'powercat.dog/(cool|watermelon5)' or 'ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz' within network proxy, traffic, or HTTP logs. A match indicates potential communication with Powercat command and control infrastructure or distribution points, warranting further investigation into the source and destination IPs, URLs, and surrounding network activity.
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
This detection identifies network connections to specific malicious domains associated with the TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8). It specifically looks for connections originating from Python-related processes (python, python3, pip) to domains like 'models.litellm.cloud' or 'checkmarx.zone'. A match indicates potential compromise and warrants investigation into the affected host, user, and surrounding activity.
This rule detects activity associated with the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It identifies two main indicators: first, process command lines that show the installation of these specific malicious versions via 'pip' or 'python -m pip'; second, network connections to a known command and control (C2) IP address (83.142.209.203) or specific C2 URLs involving '.wav' files, which are known to be used for steganography in this campaign. A match indicates a high confidence of potential compromise and warrants immediate investigation to confirm the affected host and user, assess the legitimacy of the activity, and review for follow-on malicious actions.
Faux Elevate Uac Bypass
YARA-L
This rule detects a Faux-Elevate UAC bypass technique. It correlates the launch of auto-elevated processes like 'fodhelper.exe' or 'eventvwr.exe' with the subsequent spawning of suspicious child processes such as 'powershell.exe', 'cmd.exe', or 'wscript.exe'. The detection is further refined by looking for malicious PowerShell patterns within the command line of these child processes, specifically keywords like 'IEX', 'DownloadString', 'Invoke-WebRequest', or '-enc'. Additionally, the rule identifies registry modifications targeting keys related to 'ms-settings\shell\open\command', which is indicative of a registry hijack often used in UAC bypasses.
Page 61 of 98