Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects indicators associated with the SHub Stealer v2.0 and MacSync infostealers. It looks for specific strings related to their components, update mechanisms, communication patterns, logging, and credential harvesting attempts. The rule identifies strings like "com.google.keystone.agent.plist", "GoogleUpdate.app", "api/bot/heartbeat", "osalogging.zip", "shub_log.zip", "dscl . authonly", and specific messages indicating password validation status. The presence of multiple such strings or specific combinations suggests the presence of these macOS infostealers.
This rule detects network communication with known command and control (C2) domains, ClickFix domains, and staging domains associated with macOS infostealers. It also identifies heartbeat communication patterns to these C2 domains, indicating potential active infections.
PowerShell (parent explorer) launches WScript with minimized window and Invoke-WebRequest. Lampion campaign pattern per Microsoft blog.
This rule detects suspicious activities associated with the ClickFix / CrashFix Python RAT. It identifies three main patterns: the execution of 'finger.exe' as a potential fetch mechanism, PowerShell execution with encoded commands originating from web browsers or common system utilities, and Python script execution from suspicious temporary or download directories, indicative of RATs like ModeloRAT or CastleRAT.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
This rule detects HTTP traffic that may indicate a ClickFix social engineering attack. Specifically, it looks for HTTP responses with a 'Content-Type' of 'text/plain' and content within the HTTP header that matches patterns associated with PowerShell, encoded commands, or 'iex' (Invoke-Expression), suggesting the delivery of an encoded PowerShell payload.
Detects tools like Mimikatz, NanoDump, Procdump, or Invoke-Mimikatz accessing the LSASS process with specific memory read permissions (PROCESS_VM_READ). This detection relies on Sysmon Event ID 10 and filters out legitimate svchost.exe access to LSASS.
ET PHISHING Microsoft ClickFix Landing Domain
This rule detects DNS queries to known command and control (C2) domains associated with the 'Shadow Campaigns' (TGR-STA-1030) threat group. Specifically, it looks for DNS queries ending in '.me' or '.live' that match a list of hardcoded domain patterns identified by Unit 42 as being used by this threat actor for C2 communications.
This rule detects the presence of specific file hashes associated with the Microsoft ClickFix social engineering technique. It identifies files on devices that match a predefined list of SHA256 hashes, indicating potential compromise or interaction with the ClickFix malware.
Page 86 of 98