Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
This rule detects artifacts associated with the APT36 CreepDropper malware, specifically focusing on scheduled task names and staging file markers. It looks for specific strings related to scheduled tasks like 'MicrosoftEdgesUpdatesTasksMachineUAs-Task' and 'MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy', as well as a staging file named 'ds.png' and other related strings such as 'msedge.exe', 'Task10', and 'System.Reflection.Assembly'. The rule requires at least four of these strings to be present, along with the MZ header, indicating a Windows executable.
This rule detects artifacts associated with the Havoc loader, specifically targeting a fake tech support scam. It looks for combinations of strings related to Adobe ARM staging, a 'license.key' file, and specific DLL names like 'vcruntime140_2.dll' and 'mpclient2.dll', which are indicative of the loader's operation and DLL sideloading techniques. The rule also includes a specific byte sequence ($a1) that may be a unique identifier for the Havoc loader.
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
This rule detects files associated with two distinct malware chains, ShellFolder and LOTUSLITE, which have been observed in campaigns leveraging Middle East conflict themes as bait. The ShellFolder chain detection focuses on specific file names like 'ShellFolder.exe', 'ShellFolderDepend.dll', and 'BaiNetdisk', along with a unique decryption key '20260301@@@'. The LOTUSLITE downloader chain detection identifies specific DLLs ('libmemobook.dll', 'kugou.dll'), folder paths ('C:\ProgramData\CClipboardCm\', 'C:\ProgramData\WebFeatures\'), executable names ('WebFeatures.exe'), and hardcoded URLs/IP addresses ('www.e-kflower.com', '172.81.60.97') used for persistence and downloading next-stage malware. The rule aims to identify concrete indicators of compromise rather than broad patterns, focusing on the specific artifacts reported in related threat intelligence.
This rule detects potentially risky browser sign-ins from unmanaged devices, which aligns with account access patterns observed in AiTM (Adversary-in-the-Middle) phishing campaigns like those discussed in the Tycoon2FA report. It identifies sign-ins where the risk level is elevated (50 or 100), the client application used is a browser, and device trust type and device name information are empty, suggesting an unknown or untrusted device. This serves as a lead to investigate suspicious browser-based sign-ins that might indicate an AiTM compromise.
This rule detects the creation of scheduled tasks with specific names identified in the Bitdefender APT36 Vibeware report. These task names are associated with APT36's persistence mechanisms, used to maintain malware execution, launch hidden components, and continue operations after initial infection. The rule specifically targets these known malicious task names rather than broadly detecting all scheduled task creations, aiming to provide high-fidelity alerts indicative of APT36 activity.
This rule detects suspicious sign-in links that exhibit characteristics of OAuth redirect abuse. Specifically, it looks for URLs that contain "oauth2", "prompt=none", and "scope=invalid". This pattern suggests an attempt to use a trusted sign-in service to redirect users to a malicious page, potentially for phishing or malware delivery, by manipulating OAuth parameters.
This rule is based on a phishing method that abuses normal sign-in links instead of relying on an obviously fake website at the start. The trick works by sending a person to a real sign-in service with settings that force an error and then pass the browser along to the attacker’s page. The rule stays narrow by looking for both the hidden sign-in setting and the clearly bad scope value together. That matters because silent sign-in by itself can appear in normal environments, but the bad scope value changes the story and makes the pattern much more suspicious. In plain language, this rule is trying to spot a link that pretends to be a normal sign-in step but is really being used as a doorway to a phishing or malware page after the trusted service does the redirect. Keeping both parts together helps the rule stay tied to the abusive redirect trick instead of ordinary sign-in traffic.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
Page 64 of 98