Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Archive or browser/Office recently opened then child process is executable from user temp or downloads. AI/crypto social engineering campaigns often use ZIP with double-extension executables.
Detects Remcos RAT execution via shotcut.exe running from AppData\Local\2120206 (DLL sideloading). Requires full path to avoid false positives from other Shotcut installs.
This rule detects the dropping of specific DLL files associated with OysterLoader malware within the 'AppData\Roaming' directory. The detection logic specifically looks for file creation events where the target filename contains 'AppData\Roaming' and one of the following strings: 'COPYING3.dll', 'VisualUpdater', 'AlphaSecurity', or 'DetectorSpywareSecurity'. This activity is indicative of a stage 3 drop by OysterLoader before a scheduled task is created, as detailed in a Sekoia report.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
Detects Remcos RAT payload drop - zip archive saved with .pdf extension (2120206.pdf) in user Temp. Requires known SHA256 to avoid false positives from arbitrary .pdf files; use field name your backend provides (e.g. FileHash, Hash, SHA256).
This rule detects the execution of processes with command lines containing specific strings associated with the Diaoyu loader, a component of the Shadow Campaigns espionage activity. The rule looks for the presence of 'pic1.png', 'padeqav', 'admin-bar-sprite', or 'DiaoYu' within the command line arguments of newly created processes. This activity is linked to Unit 42 TGR-STA-1030.
This rule detects suspicious commands being set in the RunMRU registry key by explorer.exe. It specifically looks for the presence of LOLBins such as powershell, mshta, and curl, as well as obfuscation techniques like caret (^) and ProxyCommand, or patterns indicative of encoded/script execution (e.g., Invoke-Expression, FromBase64String, -eC). This activity is associated with the 'ClickFix' social engineering technique.
This rule detects the execution of PowerShell, pwsh, mshta, or curl initiated by explorer.exe (specifically from the Run dialog) when the command line contains indicators of web requests, expression invocation, or encoded commands. This behavior is often associated with the 'ClickFix' social engineering technique, where users are tricked into running malicious one-liners from the Windows Run dialog. The rule looks for common PowerShell commandlets like 'Invoke-WebRequest', 'Invoke-Expression', or their aliases, as well as '-EncodedCommand' or methods like 'DownloadString' and 'FromBase64String', indicating an attempt to fetch and execute remote content or obfuscated commands.
This rule detects network communication with known command and control (C2) infrastructure associated with the OysterLoader malware. It identifies C2 activity by looking for connections to specific domains and IP addresses, as well as requests to particular API paths within the RemoteUrl field.
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
Page 82 of 98