Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the execution of known webshells such as Behinder, Neo-reGeorg, Godzilla, or reGeorg. The detection is specifically triggered when these webshells are found in the command line of a process whose parent process is a common web server application like w3wp.exe (IIS), httpd.exe (Apache), nginx.exe (Nginx), or java.exe (often used for Java-based web servers like Tomcat). This indicates potential webshell deployment and execution on a web server, which is a critical indicator of compromise, often associated with initial access or persistence by attackers.
This rule detects the execution of 'osascript' on macOS when its parent command line contains 'curl'. This pattern is indicative of a stager piping a curl response directly to osascript, often without writing a script to disk, as described in the ClickFix and MacSync/SHub delivery patterns by Datadog.
ET TROJAN Microsoft ClickFix IOC IP
The rule detects the execution of 'run.exe' where its image path contains 'SoftwareProtectionPlatform' and its command line arguments include both 'SoftwareProtectionPlatform' and 'udp.pyw'. This specific combination is indicative of the KongTuke malware establishing persistence through a scheduled task named 'SoftwareProtection'.
This rule detects the execution of 'finger.exe' with a command line containing an '@' symbol, which is indicative of ClickFix campaigns fetching obfuscated PowerShell payloads. Legitimate use of 'finger.exe' is rare on Windows, making this a high-fidelity detection for ClickFix delivery.
This rule detects activities associated with the "Shadow Campaigns" espionage operation. It identifies the "Diaoyu loader" through specific command-line arguments, C2 communication with known malicious domains, and the deployment of webshells (Behinder, Neo-reGeorg, Godzilla, reGeorg) originating from common web server processes (w3wp.exe, httpd.exe, nginx.exe, java.exe).
Detects KongTuke Python payload or launcher from fake SoftwareProtectionPlatform - Image path must contain SoftwareProtectionPlatform and command line must reference udp.pyw or run.pyw. run.pyw SHA256 6afbe1f38351f6bfdd478240a4792e96f7e2789e5aaf02abbbe2c4c9a368f736, udp.pyw SHA256 efed49010d4da096af63c48a36fb4ca61ac05b4e553bdec6ed76b9590725a99c for correlation.
Detects potential lateral movement attempts within Azure by a Service Principal (Managed Identity) executing 'runCommand' or other compute operations on virtual machines. This activity could indicate an attacker abusing a compromised Managed Identity to gain access to and control other resources.
This rule detects network connections to known malicious domains and IP addresses associated with the Microsoft ClickFix social engineering technique. It specifically looks for RemoteUrl matching a list of identified domains or RemoteIP matching a list of identified IP addresses within the last 30 days from device network events.
This rule detects suspicious process creation activity on macOS systems where `curl` output is piped directly into a shell, specifically `zsh` or `sh`. This technique is often used by attackers to execute malicious scripts directly from a remote source without writing them to disk. The rule looks for `zsh` processes with command lines containing `curl` and a pipe character, or `curl` processes with a pipe character in their command line. This behavior is associated with campaigns like Datadog Tech Impersonators (ClickFix).
Page 85 of 98