Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects when a single session identifier is used to access multiple cloud applications, where at least three distinct applications are accessed within an hour, and these applications were not part of the original interactive sign-in. This behavior can indicate a token replay attack, specifically as described in the Elastic Security Labs research on Tycoon 2FA AiTM detection engineering.
Detects a non-browser process reading browser profiles, cookies, form stores, or session files from Chrome, Edge, Brave, or Opera browsers. The rule specifically looks for file events (creation, writing, deletion) on browser-related files like 'Cookies', 'Login Data', 'Web Data', 'History', or 'Local State' within browser user data directories, where the process performing the action has a filename matching common RAT patterns like 'banana', 'client', 'update', or 'service'.
Detects a persistence script querying for a missing task or payload and recreating it when absent, indicating self-repair behaviour. This rule specifically looks for command-line activity involving 'powershell', 'cmd', or 'schtasks.exe' that queries for scheduled tasks and then attempts to create or register them, often using keywords like 'if', 'missing', 'not found', 'create', or 'Register-ScheduledTask'.
Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.
Detects cleanup of captured frames, QR images, overlay resources, or decrypted modules after a banking fraud session, specifically targeting files with names containing 'screen', 'frame', 'overlay', 'qr', 'module', or 'stage' and extensions like '.png', '.jpg', '.bmp', '.dll', '.dat', '.bin' within common temporary or application data directories. The activity is attributed to processes with 'banana', 'client', 'update', or 'service' in their base file name.
Detects appcmd.exe registering an IIS native module whose image is stored beneath Temp, AppData, ProgramData, Public, or a web-content directory, consistent with BadIIS deployment tooling. This activity is indicative of an adversary establishing persistence or further compromising an IIS web server by installing malicious modules.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Detects bash or sh executing install.sh from an OpenClaw skill directory, matching the alternate macOS and Linux GhostLoader bootstrap path. This activity is associated with the malicious OpenClaw skill distributing Remcos RAT and GhostLoader.
This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.
Detects Python executing adconnectdump.py, which targets credentials stored by Microsoft Entra Connect. This tool is used to dump credentials from Microsoft Entra Connect (formerly Azure AD Connect) installations.
Page 9 of 98