Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create)
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
Detects csc.exe compiling code from Temp or AppData locations, a common pattern for dropper and loader build steps on compromised hosts.
Detects a low-noise XWorm execution chain described by ANY.RUN where WmiPrvSE.exe spawns PowerShell that uses WebClient to fetch Cloudinary-hosted content and performs in-memory Assembly.Load.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
Detects Booking.com partner phishing lures described by Bridewell by identifying complaint/reserv URLs with op_token hosted on punycode or lookalike domains, plus the booklng sign-in tpo_token pattern.
Flags csc.exe invocations compiling from Temp/AppData paths, a practical pivot for GTIG-described malware that compiles C# code obtained at runtime (e.g., via LLM API responses).
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones targeting CVE-2026-2329. It specifically looks for HTTP requests to the `/cgi-bin/api.values.get` endpoint where the `request` parameter in the URI query string has a length greater than or equal to 65 characters, which is indicative of an oversized request parameter often used in buffer overflow or similar vulnerabilities.
Page 75 of 98