Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects a specific social engineering technique, dubbed 'ClickFix', where PowerShell is used to launch WScript or CScript. The detection specifically looks for PowerShell being initiated by explorer.exe, indicating a user interaction (e.g., clicking a malicious file or link), and then launching WScript.exe or cscript.exe. The PowerShell command line is expected to contain '-windowstyle minimized -Command' and 'Invoke-WebRequest', suggesting an attempt to download and execute a script in a hidden window.
This rule detects suspicious commands being added to the Run Most Recently Used (MRU) registry key, often associated with the Microsoft ClickFix social engineering technique. It looks for modifications to the 'RunMRU' registry key by 'explorer.exe' where the 'RegistryValueData' contains specific keywords or patterns. These patterns include the '✅' character, a combination of common scripting/execution tools (powershell, mshta, curl, msiexec) with non-Latin characters, 'mshta' not in typical benign values, 'bitsadmin', 'forfiles', 'ProxyCommand=', or 'cmd'/'powershell' commands with obfuscation techniques, web requests, or code execution indicators.
OysterLoader uses a Windows scheduled task to keep itself running. It creates a task with a name that looks like a normal security or updater tool, so it blends in. The task runs repeatedly in the background, helping the malware come back even after a restart and making it harder to notice or remove.
This rule detects the creation of scheduled tasks and the execution of rundll32.exe, both associated with the OysterLoader malware. Specifically, it looks for scheduled tasks created with specific command-line arguments including '/Create', '/SC MINUTE', '/MO 13', and known OysterLoader task names ('COPYING3', 'VisualUpdater', 'AlphaSecurity', 'DetectorSpywareSecurity'), which then execute 'rundll32' with 'DllRegisterServer'. Additionally, it identifies 'rundll32.exe' executing DLLs from the 'AppData\Roaming' directory with 'DllRegisterServer' and the same known OysterLoader names.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Detects lateral movement where a Managed Identity of one Azure resource (e.g., VM) is used to execute code or access another resource. This is identified by successful 'Microsoft.Compute/virtualMachines/runCommand' operations where the caller is a ServicePrincipal (indicated by a GUID) and the 'InitiatedBy' field contains 'resourcegroups', suggesting the action was initiated by a resource rather than a direct user.
Detects Remcos RAT persistence via HKCU Run key "Shotcut video editor" pointing to shotcut.exe under AppData\Local\2120206 (DLL sideloading). All five strings required to avoid false positives.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
This rule detects the execution of PowerShell with an execution policy bypass, specifically looking for a command line that includes 'AzureRemove-NetNatStaticMapping.ps1' and 'AppActions'. This combination is indicative of the KongTuke malware's second-stage loader, which uses a PowerShell script to load a DPAPI-unprotected payload.
Page 84 of 98