Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
CoolClient backdoor: loader/persistence/plugin behavior and artifacts
This rule detects various behaviors associated with the VoidLink threat, focusing on persistence, privilege escalation, and evasion techniques. It identifies suspicious kernel module loading from temporary directories, the presence of hidden rootkit files, container escape attempts, and cloud metadata harvesting. The rule correlates these activities to reduce false positives, specifically looking for combinations such as suspicious module loads with hidden rootkit files or container escapes, container escapes with cloud metadata harvesting, hidden rootkit files with container escapes or cloud metadata harvesting, and eBPF evasion techniques combined with suspicious module loads or hidden rootkit files. The detection logic suggests an adversary attempting to establish persistence, elevate privileges, and potentially exfiltrate cloud credentials within a Linux environment, possibly involving containerized setups.
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
Detects file activity associated with the VIMC UNITY trojan. The rule identifies two main behaviors: (1) a process running from common temporary or user data directories (Temp, AppData, ProgramData, Downloads) creating or writing to a file named 'logs.txt'; and (2) the creation of 'XClient.exe' or 'shost.exe' within Temp, AppData, or ProgramData directories. This rule can serve as a supporting indicator and should ideally be correlated with other VIMC UNITY detection rules for higher confidence.
Detects VIMC UNITY campaign trojan/loader: PE with Java Control Panel (javacpl.exe) abuse context, OpenJDK build path (javacplexec/javacpl.pdb), and behavioral strings (logs.txt, XClient.exe, shost.exe). Delivered via email lure VIMC UNITY --LUMUT PORT LAYTIME with attachment VIMC UNITY.gz.
Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.
Detects XenoRAT command and control information stealer file access activity. XenoRAT reads browser profile data, including logins.json, Web Data, Cookies, Local Extension Settings, chromium_plugins, and profiles.ini, as well as cryptocurrency wallet files such as _key.txt, _v20.txt, and directories under Wallets. The detection triggers when a process executing from a writable or temporary path, or matching known XenoRAT hashes including MalwareBazaar samples and the UPX packed variant bb7f5743, accesses these paths under AppData or ProgramData. For higher confidence, correlate with xenorat_execution on the same host.
This rule set detects various components and behaviors associated with the MAESTRO ESXi VM escape exploit. It identifies the orchestrator (exploit.exe), the MyDriver.sys unsigned kernel driver, the GetShell Plugin client, the VSOCKpuppet backdoor, the usage of Kernel Driver Utility (KDU) to load the exploit driver, and several behavioral indicators. The indicators include disabling the VMCI driver, using InfDefaultInstall, VSOCK communication, modifying inetd.conf, and artifacts with Chinese characters. The overall goal is to detect the full attack chain from initial exploit deployment to persistent backdoor access on ESXi hypervisors.
This rule detects suspicious Node.js activity potentially related to EtherRAT's React2Shell exploitation (CVE-2025-55182) and fileless execution. It looks for combinations of fileless Node.js execution patterns (using -e, --eval, or --input-type=module with common modules like require, import, fetch, http) alongside Ethereum RPC queries (eth_call, eth_getStorageAt, infura.io, alchemy.com, cloudflare-eth). It also identifies scenarios where Node.js is downloaded from nodejs.org and then persistence mechanisms are set up via .bashrc, .profile, .bash_profile, systemd, or cron. Another detection path involves fileless Node.js execution combined with systemd or cron persistence. The rule specifically targets Linux environments and process creation events.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
Page 92 of 98