Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
Detects Base64 decoded content being executed via a shell on macOS, consistent with malicious OpenClaw skill style obfuscated command execution.
This rule detects activities associated with the SSHStalker botnet. It identifies outbound IRC-like network traffic on common IRC ports (6667, 6697, 7000) over TCP. It also looks for persistence mechanisms by monitoring writes to common cron job directories and files on Linux systems. Additionally, the rule detects log tampering attempts by monitoring writes to critical system log files such as /var/run/utmp, /var/log/wtmp, and /var/log/lastlog. Finally, it identifies on-host compilation activities, specifically the execution of compilers (gcc, cc, clang) or build tools (make) within suspicious temporary directories like /tmp, /var/tmp, or /dev/shm, which can indicate malware compilation.
Detects suspected DKnife gateway AitM activity by matching Linux process/file artifacts (component names and config files) described in the Talos DKnife disclosure.
Detects access to file sharing and exfiltration services reported in the Unit 42 Muddled Libra operational playbook, including S3 Browser and multiple upload services.
This rule detects PowerShell or pwsh.exe processes executing commands that contain specific lookalike domains and paths associated with a watering-hole attack targeting EmEditor users. The rule looks for command lines containing 'emeditorjp.com', 'emeditorgb.com/run/mg8heP0r', 'emeditorde.com/gate/start/2daef8cd', or 'cachingdrive.com/gate/init/2daef8cd'. This activity indicates a potential compromise where a modified installer or malicious script is attempting to fetch additional hidden code from these domains.
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
Detects creation or presence of NTDS.dit and SYSTEM hive files in a user desktop context, consistent with reported domain controller disk mount and offline credential dumping activity.
Detects Office applications spawning scripting engines or LOLBINs often used in multi stage delivery chains associated with Agent Tesla style campaigns.
Page 73 of 98