Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects the execution of high-risk discovery or collection tools, such as vssadmin.exe, ntdsutil.exe, wevtutil.exe, certutil.exe, adfind.exe, dsquery.exe, klist.exe, or nltest.exe, when spawned by a BeyondTrust/Bomgar Remote Support session process (bomgar-scc.exe). This activity is indicative of post-exploitation behavior, potentially linked to intrusions described in CVE-2026-1731.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection logic looks for HTTP requests to the vulnerable endpoint '/cgi-bin/api.values.get' and specifically for an oversized 'request' parameter where the first identifier before a colon is 65 characters or longer, indicating a likely buffer overflow attempt.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
YARA-L that detects multiple APT28, including MacroMaze persistence: schtasks creating a task that runs wscript/cscript with .vbs and batch in the user profile.
Detects XWorm LATAM campaign artifacts via published SHA256 and unique network/mutex markers from ANY.RUN analysis.
Detects PowerShell script content consistent with ETW disable (EventProvider.m_enabled) and AMSI bypass (AmsiUtils.amsiInitFailed) described in the MIMICRAT ClickFix chain.
Detects Windows PE files that contain string indicators associated with the Diaoyu loader as reported in the Shadow Campaigns research. The rule keys on multiple distinctive strings, including references to WordPress themed artefacts, a GitHub raw content host, and Diaoyu specific markers, and requires an MZ header plus either two or more indicators or specific high confidence string pairs.
This rule detects a multi-stage attack chain. The first rule identifies the Notepad++ updater (GUP.exe) spawning curl.exe to upload reconnaissance output to 'temp.sh/upload', indicating a potential supply-chain attack. The second rule detects the execution of 'ProShow.exe' from an unusual location within the AppData\Roaming\ProShow directory, which is part of a described execution chain. The third rule identifies the execution of 'script.exe' with 'alien.ini' from the AppData\Roaming\Adobe\Scripts directory, matching another stage of the supply-chain attack.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This rule detects potential lateral movement within Azure by identifying instances where a Managed Identity of one Virtual Machine (VM) is used to execute commands on another VM. It specifically looks for Azure Activity logs where the caller is a Service Principal, the 'InitiatedBy' field (xms_mirid) contains 'resourcegroups', and the operation name indicates a 'runCommand' or a 'Microsoft.Compute' action. This combination suggests that a Managed Identity is being leveraged to perform actions across VMs, which could be indicative of an attacker moving laterally after compromising a VM with an attached Managed Identity.
Page 79 of 98