Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a user who interacted with a code-of-conduct lure subsequently authenticating through an anonymous proxy or anonymisation service. This rule correlates URL click events or sign-in events with subjects related to 'code of conduct' or 'policy acknowledgement' and then checks if the subsequent authentication occurred via an anonymous proxy.
Detects the deletion of local shadow copies using vssadmin, WMI, PowerShell, or wbadmin, a common tactic employed by ransomware to prevent system recovery.
Detects service-control activity stopping security, backup, database, or virtualisation services to unlock files and reduce resistance.
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects Electron applications attempting to establish persistence using `setLoginItemSettings` in conjunction with JavaScript code execution (`eval`) or external process execution (`child_process` and `execFile`). This combination is indicative of malicious activity, such as that observed in Clickfix attacks, where an application gains persistence and then executes arbitrary code.
Detects `cmd.exe` starting PowerShell with hidden-window, bypass execution policy, and encoded-content options, which is a common technique used by malware like Banana RAT to evade detection and execute malicious scripts. The rule specifically looks for PowerShell or pwsh.exe being launched with command-line arguments indicating hidden windows, execution policy bypass, or encoded commands, with `cmd.exe` as the parent process.
Detects a non-browser process reading active browser titles, URLs, or accessibility trees and matching Brazilian bank names before activating fraud modules. Specifically, it looks for processes named 'banana', 'client', 'update', or 'service' (case-insensitive) that are executing commands related to UI automation or window title retrieval, and simultaneously searching for banking-related keywords like 'bank', 'internet banking', 'agencia', or 'conta'.
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
Detects the ZiChatBot dropper export and parameter combination used to initialise payload decryption and execution. Specifically, it looks for rundll32 or python/python3 executing 'terminate.dll' with 'envir' and 'xterminalunicod' in the command line.
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
Page 7 of 98