Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
This detection identifies attempts to exploit CVE-2026-33017, a code injection vulnerability in Langflow, by looking for specific URL paths associated with the vulnerability ('/api/v1/build_public_tmp/') combined with indicators of scanning tools like 'nuclei' in the user agent or cookie fields. It aims to detect reconnaissance or exploitation attempts against vulnerable Langflow instances.
This detection identifies activity related to the TeamPCP Telnyx PyPI backdoor. It specifically looks for the installation of compromised 'telnyx' package versions (4.87.1 or 4.87.2) via pip, command-line interactions with a known C2 server (83.142.209.203:8080 for 'ringtone' or 'hangup' WAV files), or the presence of 'msbuild.exe' in the Windows Startup folder, which is an indicator of persistence used by this threat.
This rule detects activity associated with the Powercat malware campaign by looking for specific domains in process command lines, network connections, or unique strings like "jd-gui.jar" and "\Xeno\workspace" in process command lines. The detection focuses on high-confidence indicators observed in reporting to identify potential infostealer activity.
This rule detects a suspicious sequence of events indicative of the Albabat malware. It looks for instances where a device performs WMI-based reconnaissance (querying CPU, csproduct, OS, or NIC information) followed by or preceded by network communication with either a GitHub repository containing 'billdev' or a Supabase instance. The time window for these events is set to 30 minutes, suggesting a contextual link between the reconnaissance and subsequent network activity.
This rule detects network communication indicators associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains or specific URL paths used by the malware for authentication and data exfiltration. The detection logic combines a regular expression for a list of suspicious domains and a check for specific API paths within URLs. A match indicates potential Torg Grabber activity, warranting further investigation into the affected host and user, and review of surrounding network and system activity.
This detection identifies activity related to the ThreatLocker Powercat malware campaign, which uses fake game cheats to deliver an infostealer. The rule focuses on specific indicators observed in the campaign, including Java execution with particular command-line arguments, connections to known malicious domains (powercat.dog, ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz), and specific file paths associated with the malware. A match indicates a strong reason for investigation into potential compromise, focusing on the affected host, user, and any subsequent malicious activity.
This rule detects network connections made by a specific executable ('v20svc.exe') to domains ending with 'app-metrics-cdn.com' and containing specific URL paths ('/api/upload', '/api/upload-json', '/api/upload-complete', '/api/listener/heartbeat'). This combination of indicators is associated with the Venom Stealer malware, often delivered via fake Avast scan websites.
Page 62 of 98