Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
The rule detects instances where a Java process (java.exe or javaw.exe) spawns certutil.exe with command-line arguments indicating a URL download. This specific pattern is associated with the exploitation of CVE-2023-46604 in Apache ActiveMQ, where certutil.exe is used to download a payload. The detection logic looks for the parent process being 'java.exe' or 'javaw.exe', the child process being 'certutil.exe', and the command line of 'certutil.exe' containing both '-urlcache' and 'http', which are indicative of a file download from a URL.
Detects curl or wget download followed by chmod and execution, consistent with staged malware delivery used by malicious OpenClaw skills distributing AMOS.
Detects processes that access Google Sheets API endpoints and parameters described in GRIDTIDE reporting,
where the initiating process is not a common web browser. This may indicate abuse of Sheets as a C2 channel.
where the initiating process is not a common web browser. This may indicate abuse of Sheets as a C2 channel.
This rule detects when Node.js executes a script named 'env-setup.js' located within a '.vscode' directory. This pattern is often associated with malicious code execution within development projects, particularly when a developer opens and trusts a repository. The rule specifically looks for 'node.exe' as the image and the script path containing either '\.vscode\env-setup.js' or '/.vscode/env-setup.js' in the command line.
Detects a Java process starting cmd or PowerShell. On an ActiveMQ server this can indicate that someone is running commands after exploiting the service.
This rule helps you find files that may be part of the EmEditor watering hole incident by looking for a small set of very specific clues that were described in public reporting. It searches for lookalike website names and a repeated campaign marker that appeared in the attacker’s network paths. A match does not automatically prove malware, but it is a strong hint that the file should be reviewed, especially if it is a script, configuration, or installer related content. If you get a hit, confirm where the file came from and whether it is expected for that machine. If it is unexpected, save the file for analysis, check for other related downloads, and look for signs of credential theft or surveillance activity. Also search for the same marker across endpoints, because campaigns often reuse the same identifier on multiple victims. The intent is to give defenders an easy, reliable starting point for triage using human readable clues.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
This rule detects two related activities that could indicate the use of AI webchat services as a covert C2 proxy via WebView2. The first part identifies network connections to specific AI webchat domains (grok.com, copilot.microsoft.com) via proxy or web logs. The second part identifies the creation of the 'msedgewebview2.exe' process by unusual parent processes, excluding common browsers and Microsoft Office applications. This combination aims to catch scenarios where WebView2, often used by AI webchat applications, is leveraged for malicious command and control.
Detects execution of tools and artefacts reported in Unit 42 Muddled Libra operational playbook, including Chisel tunnelling, PsExec, ADExplorer, S3 Browser, and goon.zip staging.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
Page 72 of 98