Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Matches marker filenames and propagation strings described in the report.
This rule detects HTTP requests targeting the '/cgi-bin/api.values.get' endpoint with a 'request' parameter, which is indicative of exploitation attempts for CVE-2026-2329 in Grandstream GXP1600 series IP phones. This vulnerability allows for information disclosure.
This rule detects activities related to the DKnife gateway, which is associated with Adversary-in-the-Middle (AitM) attacks. It identifies the creation of specific DKnife process names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin), file events involving DKnife configuration artifacts (rules.conf, sslmm.cfg, url.cfg), and the presence of specific marker strings ("dkimsi=", "460110672021628", "PASSWORD") in logs or captured payloads. The rule aims to identify the presence and activity of DKnife components on Linux systems.
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
Detects process creation events where the command line contains references to 'setup_bun.js' or 'bun_environment.js' along with 'preinstall'. This combination is indicative of the SANDWORM_MODE Shai-Hulud-style worm, which leverages npm preinstall scripts to execute malicious JavaScript files.
Detects installation of the typosquatted NuGet package StripeApi.Net reported as malicious and targeting Stripe integrations.
This rule detects a multi-stage attack chain associated with BQTLock and GREENBLOOD ransomware. It identifies the staging of registry keys for a fodhelper UAC bypass, the subsequent execution of fodhelper.exe, the creation of run-key persistence, and the execution of processes containing the keyword 'greenblood' in their command line, indicating the final payload or related activity.
Detects a Windows program being run from a shared folder instead of its normal location, with an unusual command added. This can be a sign that a clean program was copied and used to run a harmful file.
Detects PowerShell executing curl.exe to download a batch script (.bat or .cmd), consistent with the Dohdoor multi stage chain described by Cisco Talos.
Detects likely exploitation attempts for CVE-2026-2329 by matching requests to /cgi-bin/api.values.get where the first identifier in the request= parameter exceeds the 64-byte stack buffer described by Rapid7.
Page 77 of 98