Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,312 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
OysterLoader stage 3 creates a scheduled task (every 13 min) running rundll32 with a DLL from AppData. Task names include COPYING3, VisualUpdater, AlphaSecurity, DetectorSpywareSecurity. Sekoia report.
This rule detects HTTP network connections to the Telegram bot API (api.telegram.org/bot). This pattern is often associated with infostealers exfiltrating data to attacker-controlled Telegram bots. The rule specifically looks for the 'NETWORK_HTTP' event type and a URL containing '/api.telegram.org/bot' (case-insensitive).
This rule detects the execution of specific download utilities (curl, wget, aria2c, fetch, PowerShell, certutil, bitsadmin, mshta) attempting to download 'install.sh' from either 'clawd.bot' or 'openclaw.ai'. This activity is indicative of potential malware or unauthorized script downloads, possibly bypassing network security controls.
This rule detects PHP webshell patterns. The first rule, 'PHP_Webshell_GatedEval_GETaaaa_POST1', identifies webshells that use a specific GET parameter 'aaaa' and a POST parameter '1' in conjunction with an 'eval' function to execute code. The second rule, 'PHP_Webshell_ASS_Base64_Eval_DQo_Delimiters', looks for webshells that utilize 'base64_decode' and 'eval' functions, often with a distinctive 'DQo=' delimiter, and receive input from at least two common web input sources like $_COOKIE, $_GET, or $_POST, along with the string 'ASS'.
This YARA rule detects the Arkanix Stealer by identifying specific strings found within its code or related artifacts. It looks for a combination of unique user agent strings, domain names associated with its command and control infrastructure, API endpoints used for session creation or data exfiltration, a secret key, and a staging identifier. The rule requires at least one domain, one endpoint, and one of the distinctive user agent, key, or staging hints to trigger, aiming to reduce false positives by combining multiple indicators.
Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.
Detects a combination of suspicious registry persistence under the Microsoft TIP AggregateResults key and PowerShell launched with ExecutionPolicy Unrestricted referencing LunarApplication. Based on publicly described artefacts and intended for tuning and validation.
This rule detects the creation or modification of specific files associated with the SHub v2.0 infostealer on macOS. It looks for a fake 'GoogleUpdate' binary within the '~/Library/Application Support/Google/' directory or a LaunchAgent plist file named 'com.google.keystone.agent.plist' in the 'LaunchAgents/' directory. These file paths are indicative of the SHub stealer's persistence mechanism, which impersonates legitimate Google update components.
Detects modification of the 'convert_hosts.sh' script on Dell RecoverPoint appliances. This technique is used by UNC6201 to establish persistence for the GRIMBOLT and BRICKSTORM backdoors.
This rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. The first signature identifies requests to the '/api/v2/featureusage' endpoint containing patterns indicative of remote code execution (e.g., '${', 'Runtime', 'getRuntime', 'exec'). The second signature detects requests for a '.jsp' file named '403', which could indicate a backdoor or web shell deployment post-exploitation.
Page 81 of 98