Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones. The detection logic specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint, with a particular focus on the 'request' parameter within the query string. A request parameter with a length greater than or equal to 65 characters is indicative of a potential exploit attempt, as this length is likely to trigger the buffer overflow.
This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.
Detects possible information stealer activity linked to AI themed lures by flagging suspicious programs launched from Downloads or Temp, connections to Telegram bot endpoints, and Python scripts run from Temp with stealer related keywords in the command line.v
Detects PowerShell launched with ExecutionPolicy Unrestricted and stdin command execution (-Command -), matching behavior described in fake Windows 11 installer campaign.
Keenadu Backdoor
YARA
Matches published Keenadu-related MD5 hashes from the report.
Behavioural detection for suspicious post exploitation commands launched from BeyondTrust Bomgar SCC sessions on Windows or Linux.
This rule detects DYNOWIPER malware. It uses two primary detection methods: 1. Known SHA256 hashes of DYNOWIPER samples as published in a report. 2. A string-based detection logic derived from CERT Polska, as reproduced in the Elastic DYNOWIPER reporting. This logic looks for specific strings related to file paths, error messages, and Windows API calls, combined with a check for the 'SeShutdownPrivilege' string and a file size constraint, within a PE file (identified by the 'MZ' header).
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Detects execution of installers from common user download locations with NSIS style command line indicators, consistent with trojanised installer delivery chains.
Detects a library file with a common Windows name being loaded from a shared folder instead of the Windows folders. This can be a sign that a fake library file is being used to run harmful code.
Page 78 of 98