Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects suspicious process creation patterns where a Java or Tomcat process (common in Ivanti EPMM) spawns a command shell (cmd.exe, bash, sh) or a process containing 'sliver' or 'implant' in its command line. This behavior is indicative of potential Remote Code Execution (RCE) abuse, particularly in the context of Ivanti EPMM vulnerabilities.
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
This rule detects various activities associated with multiple infostealers targeting macOS and Windows. It identifies the mounting of malicious Disk Image (DMG) files for DigitStealer and Atomic Stealer, curl-based exfiltration attempts by DigitStealer and MacSync, and renamed Python binaries used by PXA Stealer. The rule also looks for process execution patterns related to PXA Stealer, process injection involving cvtres.exe, and VBS/batch file drops and AutoIT abuse by Eternidade Stealer. Additionally, it detects network connections and scheduled task creation by Crystal PDF, as well as known malicious file hashes and network communication with known command and control (C2) domains associated with these threats.
ET PHISHING Microsoft ClickFix Landing Domain
This rule detects two distinct patterns associated with the 'ClickFix' social engineering technique, as described by Microsoft. The first pattern identifies the stacking of 'cmd.exe /c' commands, indicating a multi-stage command execution. The second pattern focuses on obfuscated 'curl' commands, specifically looking for escape characters within 'curl' or 'curl.exe' combined with indicators of network communication (HTTP/HTTPS URLs, PHP, or BAT file extensions). This combination suggests an attempt to download or execute malicious content using an obfuscated 'curl' command.
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
This rule detects the execution of Mimikatz or Mimikatz-related tools and scripts (e.g., DumpCreds, Invoke-Mimikatz, Invoke-Mimikittenz) by analyzing command-line arguments. It specifically looks for the use of various Mimikatz modules and commands, including those related to credential dumping (e.g., sekurlsa::logonpasswords, lsadump::sam, dpapi::masterkey), privilege escalation (e.g., privilege::debug, token::elevate), and other functionalities like Kerberos ticket manipulation (e.g., kerberos::golden, kerberos::ptt).
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
This rule detects Python RATs, specifically looking for strings associated with ModeloRAT or CastleRAT, RC4 encryption, beaconing activity, and checks for domain-joined systems. It also looks for the string 'EncodedCommand' which could indicate PowerShell usage. The rule applies to both PE files (MZ header) and potentially Python scripts (magic number 0x0A0D0D0A with 'python' string).
The rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. Specifically, it looks for unauthenticated or suspicious requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of exploitation, such as `format` parameters with values like `${`, `Runtime`, `exec`, or `getRuntime`.
Page 87 of 98