Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects the execution of a specific command-line pattern associated with the KongTuke second-stage loader. It looks for 'conhost.exe' being run with '--headless', 'powershell', '-ep bypass', 'AzureRemove-NetNatStaticMapping.ps1', and 'AppActions' all present in the command line. This combination suggests the execution of a malicious PowerShell script, likely initiated via a scheduled task, as part of the KongTuke malware's persistence or execution mechanism.
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
This rule detects the execution of script hosts (PowerShell, wscript, cscript) that are launched by either the Windows Run dialog (rundll32, dllhost) or common web browsers (Chrome, Microsoft Edge, Firefox). The script host execution is further narrowed down by looking for command-line arguments indicative of script execution, such as encoded commands or invocation of functions like 'Invoke-' or 'IEX('. This pattern is often associated with the 'ClickFix' social engineering technique where users are tricked into pasting malicious commands into the Run dialog or clicking links that trigger script execution from a browser.
This rule set detects the OysterLoader malware. The first rule, 'OysterLoader_Mutex_and_TaskNames', identifies the malware based on specific mutex names, scheduled task names, and user-agent strings ('WordPressAgent' and 'FingerPrint') used by OysterLoader. The second rule, 'OysterLoader_C2_Endpoint_Strings', focuses on identifying OysterLoader by detecting specific C2 API paths used for communication with its command and control server. Both rules require the presence of a valid PE file header (MZ magic bytes).
This rule detects OysterLoader C2 communication based on specific HTTP User-Agent strings and URI paths. It looks for 'WordPressAgent' or 'FingerPrint' in the User-Agent field combined with URIs like '/reg', '/login', '/api/kcehc', '/api/v2/init', '/api/v2/facade', or '/api/jgfnsfnuefcnegfnehjbfncejfh'. This activity is indicative of OysterLoader's multi-stage evasion techniques as described in a Sekoia report.
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
OpenClaw install.sh content: distinctive strings (survives rename)
This YARA rule set detects various artifacts associated with the Remcos RAT 'ClickFix' campaign. The rules identify persistence mechanisms (registry run keys or scripts involving 'Shotcut video editor', '2120206', and 'shotcut.exe' for DLL sideloading), archive or path indicators ('2120206' and 'shotcut.exe'), clipboard scripts used for dropping malware related to the Shotcut DLL sideloading technique.
Page 83 of 98