Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects emails containing threat-actor lure links to trojanized ScreenConnect MSI files, specifically targeting 'cld.pt' downloads with 'COMPROBANTE*.msi' patterns. The rule also looks for 'COMPROBANTE' keywords in email subjects as a fallback.
The rule detects the execution of a suspicious executable named 'sohuva_update_*.exe' from user-writable or download paths (Temp, Downloads, AppData, or ProgramData\Microsoft\MF). This execution is considered suspicious if its parent process is typically a web browser or explorer.exe, or if the parent process itself originates from one of these suspicious paths. The rule explicitly excludes legitimate executions of 'sohuva_update_*.exe' from standard 'Program Files' directories associated with Sohu installations.
This rule detects the installation path of the Evasive Panda loader/MgBot malware. It specifically looks for file events where the target filename contains '\Microsoft\MF' within the 'ProgramData' directory. To reduce false positives, it excludes file creations by trusted system installers like 'TrustedInstaller.exe' and 'msiexec.exe' when run from 'System32'. The rule also implies that the initiating process should originate from user-space directories or the same '\Microsoft\MF' path, though this is not explicitly enforced in the final condition.
The rule detects the execution and persistence mechanisms of the HoneyMyte CoolClient backdoor. It identifies specific command-line arguments used during execution (' install', ' work', ' passuac') when launched by particular parent processes (Sang.exe or Jarte.exe). It also looks for the creation of 'write.exe' as a child process originating from common data directories (ProgramData, AppData, Temp). Additionally, the rule identifies persistence mechanisms by searching for command lines related to 'media_updaten' (likely a service) or 'ComboxResetTask' (likely a scheduled task).
This rule detects highly specific URI patterns associated with Evasive Panda DNS poisoning lures. It looks for requests to 'dictionary.com' that include 'image?id=' and 'dict-homepage.png' within the URI. This combination of URI components is considered high-fidelity for detecting the second-stage shellcode fetching mechanism used by Evasive Panda. The rule explicitly states that legitimate dictionary.com image requests rarely use this exact query pattern, making this a targeted detection for the described threat.
Detection of Evasive Panda secondary loader. Context: evteng.exe (signed Python wrapper) must run from C:\ProgramData\Microsoft\eHome (abuse path), not from standard Python install. Process image path contains eHome and executable is evteng.exe; parent may be same path or MFloader. Excludes evteng from Program Files or standard Python locations.
This rule detects behaviors associated with HoneyMyte post-exploitation scripts. Specifically, it looks for `curl.exe` or `curl` being used to download executables or files into 'Libraries' or 'Public' directories. It also identifies executables named `getlogindata.exe` or `getlogindataedge.exe` when their command line arguments contain 'Login Data' or 'Local State', indicating browser credential theft. Additionally, it detects `powershell.exe` or `cmd.exe` command lines that include keywords related to HoneyMyte's exfiltration methods (e.g., 'pixeldrain', 'PIXELDRAIN', '113.23.212', 'log.dat', 'nbtscan').
This rule detects file behaviors associated with the HoneyMyte CoolClient browser stealer. It identifies the creation of a file named 'License.txt' within the 'C:\Users\Public\Libraries' directory, which is used by the stealer to store credentials. Additionally, it looks for access to browser login data files such as 'Login Data' and 'Local State', or the presence of 'chromeTmp' within temporary directories ('Temp', 'AppData', 'ProgramData'). The rule also specifically flags the creation of 'Local State-journal', which is indicative of the stealer's activity in decrypting browser keys.
Detects execution of the VIMC UNITY campaign trojan/loader. The malware is delivered via phishing email with subject "VIMC UNITY --LUMUT PORT LAYTIME" and attachment VIMC UNITY.gz (gzip containing the PE). The binary masquerades as or abuses Java Control Panel (javacpl.exe).
This rule detects the multi-stage VoidLink C2 loader chain by identifying a combination of behaviors. It looks for fileless execution, specifically processes running from memory file descriptors or /proc/[pid]/fd paths. It also identifies kernel thread masquerading, where processes attempt to mimic legitimate kernel threads by using command lines like '[kworker/...]' or '[migration/...]' in conjunction with non-kernel executable paths. The rule further identifies staging activities, such as processes executing from common temporary directories like /tmp, /dev/shm, or /var/tmp. Additionally, it looks for specific VoidLink artifacts in command lines, including '.vl_', 'stage[0-9].bin', 'implant.bin', or C2 communication patterns like '/api/v2/(handshake|sync)'. Finally, it detects anonymous network activity, where a deleted executable (indicating fileless execution) is associated with network connection utilities like curl, wget, or socket/connect calls. The rule triggers when specific combinations of these behaviors are observed, such as fileless execution combined with kernel masquerading, or fileless execution combined with staging, or kernel masquerading combined with staging, or VoidLink artifacts combined with fileless execution or kernel masquerading, or anonymous network activity combined with kernel masquerading or staging. This correlation aims to reduce false positives by requiring multiple indicators of compromise.
Page 91 of 98