Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects activity associated with BRUSHWORM/BRUSHLOGGER malware. It looks for network connections to the domain 'dawnnewsisl.com' with a URL path containing '/updtdll'. Additionally, it checks for process execution from a specific path pattern (e.g., '\ProgramData\Photoes\Pics\*.exe') or 'rundll32.exe' executing 'C:\Users\Public\Libraries\Recorder.dll'. The combination of these indicators aims to identify high-confidence BRUSHWORM/BRUSHLOGGER activity.
Detects the Faux-Elevate UAC bypass technique where auto-elevated binaries (fodhelper.exe, eventvwr.exe) are abused to launch suspicious child processes like PowerShell or cmd.exe. The detection logic further correlates this with registry modifications related to UAC bypass (specifically 'Software\Classes\ms-settings\shell\open\command') and subsequent outbound network activity to retrieve payloads, indicating a full chain of execution and C2 communication.
This rule detects artifacts associated with the Auto-Color Linux backdoor. Specifically, it looks for the presence of the malicious library 'libcext.so.2', which mimics a legitimate library, or modifications to '/etc/ld.preload' for persistence and dynamic linker hijacking. It also identifies specific file paths used by the malware, such as '/var/log/cross/auto-color' or files within '/tmp/cross/' with a 'config-err-' prefix.
This rule detects emails containing a specific URL (https://openclaw.ai/install.ps1) which is known to host a PowerShell script. This indicates a potential attempt to deliver malicious code via email, likely as part of a phishing campaign to execute the script on the recipient's system.
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
Detects possible MuddyWater related activity in Microsoft Defender XDR Advanced Hunting by correlating suspicious process, network, file, and logon telemetry into a unified timeline. The hunt focuses on behaviours reported in the Huntress MuddyWater attack chain, including Remote Desktop logons, reconnaissance commands, OpenSSH reverse tunnelling, suspicious network connections, and possible DLL side loading involving FMAPP.exe and FMAPP.dll.
This rule detects a Python process loading a DLL named 'python20.dll'. This specific combination was observed in the CL-UNK-1068 activity, where attackers used this technique for purposes such as launching scanning tools, maintaining covert tunnels, or executing other malicious programs while attempting to blend in with legitimate software. The rule focuses on this specific pattern to identify strong leads related to the campaign, rather than generating broad alerts for all Python activities or DLL loads.
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
This rule detects the execution of specific malicious JavaScript files (`install.js` or `version.js`) associated with the StegaBin campaign, launched by the Node.js runtime. The detection focuses on the exact file paths identified in the campaign to minimize false positives, as these files are part of a harmful developer package designed to hide its next moves behind normal-looking setup work. Successful detection indicates the initial stage of a supply chain attack, potentially leading to secret theft, remote control, or further payload downloads.
This rule detects the creation of scheduled tasks with names specifically identified in the Bitdefender APT36 Vibeware report. These task names are used by APT36 to maintain persistence for their malware, often disguised as legitimate system processes.
Page 63 of 98