Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
Malware often hides its payload in folders that look legitimate. In this case, it uses a path that sounds like an Intel driver folder, but it is fake. A real Intel installer would use a different, standard path. What makes this suspicious is that the file is created by a script, such as PowerShell or a batch file, not by an installer. Normal software installs show a setup wizard and write to known locations. Here, a script writes a file with an unusual name to a folder that mimics a trusted vendor. Security teams should treat any file created in this path by a script as highly suspicious. This rule helps catch that behaviour early in the attack.
This rule detects activities associated with the Evasive Panda APT, specifically looking for network connections to known malicious IP addresses, the creation or modification of specific files and processes related to 'sohuva_update' and 'evteng.exe' in 'Microsoft\MF' or 'Microsoft\eHome' directories, and network connections to specific URLs containing 'dictionary.com' or 'p2p.hd.sohu.com' patterns. These indicators are linked to the MgBot malware and DNS poisoning tactics used by the Evasive Panda APT group.
This rule detects several suspicious activities potentially related to the 'Shadow Campaigns' threat actor, including the 'Diaoyu loader' and 'ShadowGuard' malware. It identifies processes created with specific command-line arguments (e.g., 'pic1.png', 'padeqav', 'DiaoYu', 'admin-bar-sprite', 'raw.githubusercontent.com' with 'WordPress') and network connections to known C2 domains (e.g., 'gouvn.me', 'dog3rj.tech', 'zamstats.me', 'msonline.help', 'pickupweb.me', 'servgate.me', 'abwxjp5.me', 'brackusi0n.live', 'emezonhe.me', 'pr0fu5a.me', 'q74vn.live', 'zrheblirsy.me'). The rule also looks for connections to 'mega.nz' or 'mega.co.nz' initiated by common office applications or browsers, which could indicate data exfiltration or download of malicious content. Additionally, it identifies processes created with command-line arguments related to specific security software (e.g., 'Avp.exe', 'SentryEye.exe', 'EPSecurityService.exe', 'SentinelUI.exe', 'NortonSecurity.exe'), which might indicate attempts to disable or interfere with security products. Further, it detects processes created with command-line arguments indicative of Java-based web shells or tunneling tools (e.g., 'rce.jar', 'crowd' and 'jar', 'Behinder', 'Neo-reGeorg', 'Godzilla', 'reGeorg') when initiated by web server processes. Finally, it looks for specific strings ('kill -900', 'kill -901', 'swsecret') in security logs, which could be related to specific attack techniques or tools.
Malware often tries to hide inside programs that users trust. In this attack, it runs its code inside Windows apps like OneDrive, RuntimeBroker, or similar system processes. These apps are signed by Microsoft and run in the background, so they attract less attention. The malware uses PowerShell to put its code into those processes. Once inside, the malicious code runs as if it were part of the trusted app. This makes it harder for security tools and users to spot. Normal use of these apps does not involve PowerShell accessing them in this way. Security teams should treat PowerShell or a renamed PowerShell accessing these specific processes as a strong sign of an attack. This rule helps detect that behaviour.
This rule detects activity associated with the DeadVax threat. It correlates network connections to specific malicious domains (w3s.link, mingyitc.com, ipfs.w3s, PurchaseOrder, bafybeiaj6jw2xhbppgji757tn3hg5uu6splaa5gyydkwnzwprzakcp44ve) with subsequent process creation or file modification events. Specifically, it looks for the creation of processes like 'mbs.exe' or scripts like 'rEgX.cmd', 'boot64x.w', or 'IntelDriver' within a two-hour window of the network connection. It also identifies specific command-line patterns involving 'mbs.exe' and 'rEgX.cmd' with 'Get-Content', file creations/modifications of 'boot64x.w' in 'IntelDriver' folders, creation of files ending with '_windows.dll_' in 'temp' or 'ProgramData' directories, and creation of '.bat' files in 'temp\temp' by scripting engines. Additionally, it correlates the creation of 'boot64x.w' in 'IntelDriver' with network connections to the malicious domains within a one-hour window, indicating a payload delivery followed by C2 communication.
Malware sometimes creates files with names that look like system files. In this attack, it creates a file with a name that sounds like a Windows DLL. But the file is not a real DLL. It is a text file that holds hidden, encoded data. The malware uses it to pass data between stages of the attack. A script creates this file, not a normal program install. It appears in temp or ProgramData folders, which are common places for malware to hide. Real DLLs are usually installed by installers in specific system folders. Security teams should treat this exact filename being created by a script as highly suspicious. This rule helps catch that behaviour before the next stage runs.
This rule detects potential malware execution and persistence by correlating suspicious script and HTA activity with known malicious infrastructure. It flags mshta, wscript, and cscript executing remote HTA or script content, related network connections and downloads, temporary file artefacts, connections to listed suspicious domains and IPs, attempts to add Windows Defender exclusions, and fake browser update style process launches that retrieve executables over HTTP.
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
This rule detects attempts to disable Windows Defender and Windows Firewall via registry modifications using the 'reg add' command. Specifically, it looks for command-line arguments that include 'add', 'REG_DWORD', and keywords related to disabling Defender features (DisableAntiSpyware, DisableBehaviorMonitoring, DisableRealTimeMonitoring, DisableOAVProtection) or the 'mpssvc' service, along with setting the value to '4' or '1'. This activity is often associated with malware attempting to evade security controls.
Page 88 of 98