Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects sign-ins by Azure Managed Identities where the token was likely obtained via the Instance Metadata Service (IMDS). It identifies these sign-ins by looking for 'ImdsIdentityProvider' in the UserAgent or 'Imds' in the ClientCredentialType within AADManagedIdentitySignInLogs. This activity could indicate lateral movement through abuse of managed identities attached to virtual machines.
This rule detects suspicious activity related to a malicious Notepad++ updater, specifically looking for command strings that indicate data exfiltration to 'temp.sh' using 'curl.exe'. It identifies the presence of 'temp.sh/upload', '--user-agent', 'temp.sh/', '/list', and 'curl.exe' within the analyzed content, suggesting an attempt to upload data or list contents to a temporary sharing service.
This rule detects the MIMICRAT custom RAT by identifying specific byte patterns within files or memory. These patterns were published by Elastic Security Labs and are indicative of the malware's presence.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Detects registry value set events in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU where the parent process is userinit.exe, indicating Run dialog command history updates during interactive logon sessions. The rule flags nslookup including obfuscated character separated variants, and other common network discovery tooling often used in social engineering driven copy paste execution workflows. This can indicate ClickFix style activity or early stage network discovery typed via Win plus R.
This rule detects suspicious activity involving the Windows RunMRU registry key followed by a process launch. Specifically, it looks for modifications to the `RunMRU` registry key that contain certain suspicious strings (e.g., `nslookup`, `dig`, `powershell`, `cmd.exe`, `curl`, `wget`, `certutil`, `bitsadmin`, or various command-line obfuscation/download patterns). Subsequently, it correlates this registry modification with a process launch on the same host and by the same user, where the process command line also contains one of these suspicious strings. This behavior could indicate an adversary attempting to establish persistence or execute malicious commands.
Detects Python executing pip installs for common Arkanix loader dependencies (requests, pycryptodome, psutil) as described in the report.
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
This rule detects attempts to download the 'clawd.bot' or 'openclaw.ai' installation scripts using various command-line tools. It specifically looks for the use of 'curl', 'wget', 'aria2c', 'fetch', 'powershell', 'pwsh', 'certutil', 'bitsadmin', or 'mshta' when their command lines contain either 'clawd.bot/install.sh' or 'openclaw.ai/install.sh'. This activity is indicative of potential malware deployment or initial access attempts related to the OpenClaw/Clawd threat.
This rule detects the execution of bash or sh scripts that contain specific keywords associated with the OpenClaw installation process. It looks for command lines that include "openclaw" along with other distinctive strings such as "run_remote_bash", "OPENCLAW_INSTALL_SH_NO_RUN", "OPENCLAW_USE_GUM", "All your chats, one OpenClaw", ".openclaw/openclaw.json", or "openclaw.ai/install.sh". This aims to identify potential OpenClaw installation attempts, even if the script itself has been renamed.
Page 80 of 98