Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects artifacts associated with the RenEngine, HijackLoader, and Lumma campaigns. It identifies these threats through a combination of specific MD5 hashes, high-signal domain markers (both distribution and C2 domains), and unique filenames. The rule triggers if a file's MD5 hash matches one of the known malicious hashes, or if it contains at least one specific filename in conjunction with at least one domain marker, or if it contains at least two distinct domain markers (either distribution or C2).
Detects execution or presence of DYNOWIPER-related files by matching the published SHA256 hashes from the Elastic Security Labs DYNOWIPER report.
Detects AutoIt launching `jsc.exe`, matching the CastleLoader stage that hollows into `jsc.exe` per ANY.RUN analysis.
Detects creation or modification of a systemd service file referencing xapt or related artefacts,
consistent with reported GRIDTIDE Linux persistence patterns.
consistent with reported GRIDTIDE Linux persistence patterns.
This rule detects activity associated with the RenEngine campaign, which utilizes HijackLoader to deliver Lumma Stealer and ACR Stealer. It identifies malicious activity through three main methods: 1) Endpoint detection of known MD5 hashes associated with the malware, 2) Network traffic (proxy/DNS/netflow) to distribution sites used by the campaign, and 3) Network traffic (proxy/DNS/netflow) to known Lumma Stealer C2 domains.
Detects execution of a suspicious payload from common staging locations used in multi stage campaigns.
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
Detects RenEngine/HijackLoader/Lumma artifacts by matching the published MD5 hashes provided in the Securelist RenEngine campaign report.
Detects downloads of the Huorong themed archive name reported in a ValleyRAT delivery chain.
This detection is designed to help you find activity related to COLDRIVER new ROBOT malware chain (NOROBOT/YESROBOT/MAYBEROBOT). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Page 74 of 98