Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
This hunting query searches Defender XDR telemetry for activity consistent with the GRIDTIDE campaign by combining network, process, and file-based indicators. It identifies endpoint connections to published campaign infrastructure, including known IP addresses and dynamic DNS-style domains. It also looks for direct access to Google Sheets API endpoints and parameters described as part of the actor’s command-and-control workflow, particularly when the initiating process is not a normal web browser. In addition, it checks for file and process indicators associated with reported GRIDTIDE artefacts by matching published SHA-256 hashes and common artefact filenames. Results are returned as a unified view with a match type label to help triage whether the alert is driven by network IOC matches, Google Sheets API usage, or host artefact indicators.
This detection is designed to help you find activity related to Intellexa Predator /
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google WinRAR CVE-2025-8088 Exploitation. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: WinRAR launching a command shell or scripting engine. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/exploiting-critical-winrar- vulnerability) to document where the indicator came from and to support incident notes and reporting.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google Residential Proxy Network Disruption. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a DNS lookup to a specific domain mentioned in the report. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest- residential-proxy-network) to document where the indicator came from and to support incident notes and reporting.
DPRK EtherHiding (UNC5342) - DNS lookup for blockchain explorer APIs (multi-provider)
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
This detection is designed to help you find activity related to BRICKSTORM espionage backdoor (appliances/vCenter). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Detects clearing of Windows event logs. This can be used to hide what happened on a host.
Page 68 of 98