Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
Detects creation or modification of goon.zip, an attacker staging archive reported by Unit 42 in a Muddled Libra intrusion.
Detects execution of processes with filenames referenced in GRIDTIDE reporting, such as xapt and related components.
Detects Booking.com partner phishing kit artifacts described by Bridewell (op_token complaint lures, tpo_token sign-in flow, booklng subdomain, punycode homograph infra).
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection is based on requests to the '/cgi-bin/api.values.get' URI path, which is associated with the vulnerability.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
Detects registry modifications consistent with the fodhelper.exe UAC bypass technique (ms-settings handler), which is explicitly referenced in ANY.RUN's BQTLock behavioral writeup.
Detects access to Huorong typosquat and intermediary redirector domains reported by Malwarebytes as part of a ValleyRAT distribution campaign.
This rule detects the presence of specific file hashes associated with the RESURGE malware, which targets Ivanti Connect Secure devices, as published by CISA in AR25-087A. A match indicates a high probability of compromise on an Ivanti Connect Secure appliance.
Matches published CastleLoader stage hashes from ANY.RUN analysis.
Page 76 of 98