Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the execution of 'TOOLSIQ.EXE' (Zoho ManageEngine RMM) or 'Velociraptor.exe' when their parent process is either 'java.exe' or 'wrapper.exe'. This specific parent-child process relationship is indicative of post-exploitation activity, particularly in the context of a compromised SolarWinds Web Help Desk host, as described in the rule's context. The rule aims to identify the deployment of remote monitoring and management tools or C2 frameworks following an initial compromise.
This attack starts when a user clicks a link in an email or message. The link opens what looks like a document, such as a purchase order or PDF. In reality, it is a fake file that runs a script when opened. The script then loads the malware. The activity is started from the browser or file explorer, which is normal for a user opening a file. But the combination of opening a document and then immediately running a script is suspicious. Legitimate documents do not run scripts when you open them. Security teams should look for cases where a user opens a file from a link and that file starts a script process. This rule helps catch that first step of the attack.
This rule detects potential exploitation of CVE-2026-21509, a Microsoft Office security bypass vulnerability. It specifically looks for Microsoft Office applications (Word, Excel, Outlook) spawning 'reg.exe', 'regsvr32.exe', 'cscript.exe', or 'wscript.exe' with command-line arguments indicative of COM object registration or manipulation, such as 'CLSID', 'InProcServer32', 'prnfldr', or 'DllInstall'.
When a user opens a fake document in this attack, the document runs a script in the background. That script creates a batch file in a hidden temp folder. The folder structure is unusual: a temp folder inside another temp folder. The batch file has a random-looking name. Normal programs rarely create batch files in this way. Legitimate installers might use temp folders, but they do not typically create nested temp paths with batch files. The script that creates this file is started by the document, not by the user. Security teams should look for batch files being written to this specific path by a script process. This rule helps catch that staging step before the malware runs.
In this attack, malware uses a renamed copy of PowerShell to read a hidden file and run it. The file contains more malware that gets executed in memory. What makes this suspicious is that the activity is started by a batch or command script, not by the user directly. A normal user would run programs by double-clicking or from a menu. Here, one script launches another, which then reads and runs hidden content. This is a common pattern in multi-stage attacks where each step hides the next. Security teams should look for this chain: a batch or command window starts a process that reads a specific file and executes what it finds. This rule helps catch that behaviour before the full malware takes over.
This rule set detects various artifacts associated with the DeadVax campaign, which deploys AsyncRAT. It includes rules for known file hashes, VHD lure files, WSF scripts, components of the script chain (rEgX.cmd, mbs.exe, boot64x.w, IntelDriver), phishing MSG files, AsyncRAT shellcode markers, persistence mechanisms (scheduled task name), loader components, network indicators (C2 and IPFS delivery URLs), and common process injection targets (RuntimeBroker, OneDrive, taskhostw, sihost) combined with API calls indicative of injection.
In this attack, malware is delivered through links or cloud storage. The attacker uses specific websites and services to host the fake documents. When a user clicks a link in a phishing email, they may be taken to one of these sites. The sites can look legitimate because they use well-known web infrastructure. But they are known to host the fake documents used in this campaign. Security teams should monitor for connections to these domains and URLs. Blocking or alerting on them can stop the attack before the user downloads the malicious file. This rule helps identify when a device is connecting to these known bad locations. Early detection allows teams to warn users or block the connection.
This rule detects the creation of a process that involves 'qemu' in its image path and contains 'hostfwd=tcp' along with either 'vault.db' or 'bisrv.dll' in its command line. This combination is indicative of an SSH backdoor deployment, specifically observed in the context of SolarWinds Web Help Desk exploitation where threat actors establish persistence using a scheduled task named TPMProfiler to execute QEMU with an SSH port forward.
This rule detects the creation of a scheduled task with 'TPMProfiler' in its command line. This specific task name has been observed in malicious contexts related to SolarWinds Web Help Desk exploitation, typically used for persistence to run QEMU for an SSH backdoor. While legitimate TPM-related tasks exist, the 'TPMProfiler' name in this context is indicative of compromise.
This rule set detects various components associated with APT28's 'Operation Phantom Net Voxel'. It includes rules for the BeardShell C++ backdoor, a steganography loader DLL (prnfldr.dll), Covenant HTTP Grunt activity using Koofr for C2, and several VBA macro variants. The VBA macros are designed to drop and execute components, interact with images for steganography, use ADODB.Stream for file operations, and interact with kernel32 and advapi32 APIs for process creation and registry manipulation.
Page 89 of 98