Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects the execution of msiexec.exe with command-line arguments indicating a silent installation (`/q`, `/i`) and the download of an MSI package from a remote HTTP or HTTPS source. The detection specifically looks for this activity when the parent process is cmd.exe, and the grandparent process is java.exe, which is associated with SolarWinds Web Help Desk exploitation (CVE-2025-26399, CVE-2025-40551). This pattern suggests post-exploitation payload delivery via MSI from a compromised Java process.
This rule detects potential COM hijacking activity associated with APT28's Phantom Net Voxel operation. Specifically, it looks for command-line executions that involve the CLSID_Printers identifier ('2227A280-3AEA-1069-A2DE-08002B30309D') or the 'prnfldr.dll' file, particularly when 'regsvr32' is used. The detection is contextualized by checking if the process originates from common Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or script hosts (wscript.exe, cscript.exe), indicating a potential initial access vector or execution from a malicious macro.
This rule detects the creation of specific image files (windows.png, koala.png, or Default.png) in common application data directories (AppData\Local\ or ProgramData\). The creation event must be initiated by Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or prnfldr.dll. This activity is indicative of APT28's Phantom Net Voxel operation, which uses steganography to embed shellcode within these image files.
This rule detects network connections to cloud storage services Koofr, IceDrive, and Filen (koofr.net, icedrive.net, filen.io, filen.net, filen-1.net, filen-2.net) from non-browser processes. This activity is indicative of potential command and control (C2) communication, as APT28 has been observed using these services for C2, with tools like Covenant Grunt and BeardShell communicating via their APIs. The rule specifically filters out connections originating from common web browsers (msedge.exe, chrome.exe, firefox.exe) to reduce false positives.
This rule detects the creation or modification of 'status.dat' or 'perf.dat' files within the 'C:\ProgramData\Microsoft\eHome' directory. The detection is specifically triggered when the process performing this file operation is either 'evteng.exe' or another process located within the 'eHome' directory, or 'libpython2.4.dll'. This activity is associated with the Evasive Panda secondary loader.
This rule detects post-exploitation activities originating from the `telnetd` process, specifically targeting scenarios following an Inetutils Telnetd authentication bypass. It identifies three main categories of malicious activity: reconnaissance, SSH key injection for persistence, and malware deployment. Reconnaissance activities are detected by commands like `uname -a`, `id`, `cat /proc/cpuinfo`, or `cat /etc/passwd` executed via common shells (`/bin/sh`, `/bin/bash`, `/bin/ash`). SSH key injection is identified by `echo` commands attempting to write SSH public keys (e.g., `ssh-rsa`, `ssh-ed25519`) into `~/.ssh/authorized_keys` or `/root/.ssh/authorized_keys`. Malware deployment is detected by `nohup` commands executing `curl` or `wget` to download and pipe content to interpreters like `python`, `python3`, `sh`, or `bash`.
This rule detects exploitation attempts targeting Inetutils Telnetd's authentication bypass vulnerability. It specifically looks for patterns in network data during Telnet negotiation (destination port 23, TELNET protocol) that indicate an attempt to inject '-f' into the USER environment variable. This can occur either directly during Telnet negotiation or through a combination of IAC (Interpret As Command) negotiation for environment variables and subsequent USER variable injection with the '-f' flag, potentially alongside specific terminal configurations like 'XTERM-256COLOR' or 'screen-256color' and common baud rates.
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
This rule detects network traffic indicative of the Evasive Panda APT's use of a specific SohuVA lure. It looks for connections to 'p2p.hd.sohu.com' with the path '/foxd/gz' combined with specific query parameters such as 'sohunewplayer', 'new=/66/157/', or 'ovztb0wktdmakeszwh2eha'. The detection logic applies to both 'c-uri' and 'RequestUrl' fields, suggesting it targets proxy or web traffic logs. The rule aims for high fidelity by combining these specific URL components and parameters, differentiating it from generic Sohu update traffic.
HoneyMyte browser credential stealer (Chrome/Edge Login Data, Local State, chromeTmp)
Page 90 of 98