Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule looks for a Python process loading a helper file called python20.dll, which was part of the toolset used in the CL-UNK-1068 activity. The rule is useful because it combines two details that are not common together in modern normal use: a current Python process and an old helper file name used as a loading trick. It does not try to flag every Python action or every helper file, which helps reduce noise. In plain language, the rule is meant to catch a hidden helper attached to Python that can be used to start other attacker tools while blending in with a familiar program name. When this match appears, it can point to scanning, hidden connections, or other follow-on activity described in the campaign. The focus on the exact file name helps keep the match useful and lowers the chance of confusing it with ordinary Python use.
This rule detects the execution of specific Node.js scripts associated with the StegaBin package campaign. It looks for 'node.exe' or 'node' processes executing command lines containing 'scripts/test/install.js' or 'vendor/scrypt-js/version.js'. The intent is to identify the initial phase of a malicious package installation chain, which could lead to further compromise.
This rule detects the execution of 'ADNotificationManager.exe' from a specific path within 'ProgramData\Adobe\ARM\'. This activity is associated with a support-scam malware chain, specifically Havoc Loader, which stages itself in a folder designed to mimic legitimate Adobe directories. The rule focuses on this unusual path and exact helper name to identify the transition from social engineering to malicious execution, aiming to provide a strong lead for review by flagging suspicious activity in a trusted-looking directory.
This rule detects instances where a Python process loads the 'python20.dll' file. This activity is suspicious because 'python20.dll' is an older Python 2 library, and its loading by a Python process in modern environments may indicate a sideloading technique. This could be indicative of an attacker using Python as a cover to load malicious helper files for reconnaissance, tunneling, or other post-exploitation activities.
This rule detects artifacts associated with the UAT-9244 threat actor, specifically targeting components of their toolset. The rule `UAT_9244_TernDoor_WSPrint_Chain` identifies strings related to the Windows backdoor chain involving WSPrint and TernDoor, including DLL names, a loader key, and device names. The rule `UAT_9244_PeerTime_Backdoor` focuses on the PeerTime Linux backdoor by looking for specific strings like 'angrypeer', 'BitTorrent', 'busybox', 'docker -q', and associated domains. The rule `UAT_9244_BruteEntry_ORB` detects markers for the BruteEntry brute-force tool, including its version string, tasking paths, and cracked agent messages. The overall purpose is to identify the core files and components used by UAT-9244 for access, lateral movement, and scanning.
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
This rule is meant to catch a very specific web request pattern tied to the SolarWinds Web Help Desk issue described in the report. The attack sends a crafted request to a known application path and includes a small group of values that are unusual in normal traffic but important in the exploit chain. The rule stays tight by requiring the request method, the path, and the special body values together. That matters because web applications often have busy and messy traffic, and loose matching on only one keyword would create noise. In plain language, this rule tries to spot a request that is not just using the help desk site, but is trying to abuse it to make the server handle attacker-controlled data in a dangerous way. It is best used as a high-confidence lead for review rather than a generic web alert. When it fires, it should be treated as a focused sign of attempted abuse rather than normal help desk.
This rule detects the creation of a scheduled task named "WSPrint" that executes "C:\ProgramData\WSPrint\WSPrint.exe" at system startup. This specific pattern of `schtasks.exe` usage, including the task name and program path, is associated with persistence mechanisms described in the Cisco Talos UAT-9244 report.
This rule detects command-line access to cloud metadata services from utilities such as curl, wget, busybox, or python. It specifically looks for command lines containing IP addresses or hostnames commonly associated with cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal, 100.100.100.200) or metadata paths (e.g., /latest/meta-data, /computeMetadata/v1/). This is a hunting rule designed to identify unusual process activity that might indicate a cloud-aware malware framework attempting to discover cloud environment details.
This rule detects the presence of specific file hashes associated with the TrustConnect campaign on devices. It directly identifies known malicious lure files by their SHA256 hash, providing a narrow and high-confidence detection for triage and initial checks.
Page 65 of 98