Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
This rule detects activities associated with the EtherRAT self-propagating worm, specifically its module for scanning and exploiting vulnerable Next.js applications. It looks for combinations of mass port scanning tools (nmap, masscan, zmap, nc) targeting common web ports, logging of Next.js scan activities, `curl` commands with specific `Next-Action` headers indicative of Next.js exploitation, `node` or `nodejs` processes performing network connections to private IP ranges, and command lines containing patterns related to prototype pollution exploitation (e.g., `__proto__`, `constructor.prototype`). The rule correlates these activities to identify potential exploitation attempts against Next.js applications using the React2Shell vulnerability (CVE-2025-55182) and subsequent lateral movement or payload delivery.
The first rule, 'GlassWorm_Malware_Executable', detects GlassWorm malware executables by looking for a combination of specific string patterns and the presence of 'logs.txt'. It requires the file to be a Windows executable (MZ header). The detection logic combines multiple conditions, including the presence of specific character patterns ($char_pattern1, $char_pattern2, $char_pattern3) along with 'logs.txt', and optionally regex patterns related to 'glassworm' in names, filenames, or function names. The rule also enforces minimum counts for 'logs.txt' and the character patterns. The second rule, 'GlassWorm_Logging_Activity', focuses on detecting GlassWorm logging activity within a Windows executable. It requires the presence of 'logs.txt' and specific character patterns ($char_pattern1, $char_pattern2, $char_pattern3), with stricter minimum occurrence counts for 'logs.txt' compared to the first rule. Both rules are designed to identify GlassWorm based on its characteristic strings and logging behavior.
This rule detects potential web server hijacking and traffic redirection activities, specifically focusing on techniques used by EtherRAT. It identifies scenarios where Nginx or Apache configurations are modified, often preceded by backup creation, and followed by a web server restart. Additionally, it looks for instances where configuration modifications are combined with attempts to exfiltrate data to webhook.site, suggesting a malicious redirection setup.
Detection of EtherRAT's SSH backdoor module that appends attacker-controlled public keys to authorized_keys. The rule correlates the creation of the .ssh directory with key injection and permission setting. It also identifies direct writes or appends to authorized_keys, and specific chmod operations on authorized_keys. Additionally, it looks for Node.js processes writing or appending to authorized_keys, indicating potential automated key injection.
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
This rule detects various stages of the KONNI AI-generated PowerShell backdoor execution chain. It identifies the initial LNK loader executing obfuscated PowerShell, the creation of a scheduled task for persistence (specifically looking for 'OneDrive' and 'Startup' in the task name and hourly/monthly execution), XOR decryption activities involving PowerShell and specific file paths like 'C:\ProgramData\VljE', the creation of a staging directory 'C:\ProgramData\VljE', and the extraction of CAB files into 'ProgramData'. The detection logic combines these elements, looking for the LNK loader, or a combination of scheduled task creation with XOR decryption, or staging directory creation with XOR decryption, or CAB file extraction.
This rule detects the KONNI malware's persistence mechanism, which involves creating a scheduled task disguised as a OneDrive startup task. The task is configured to execute hourly and launches an obfuscated PowerShell script. The detection logic specifically looks for the creation of a scheduled task using 'schtasks.exe' with hourly execution, a command line containing 'OneDrive' and 'Startup Task', and a hidden PowerShell window. Additionally, it detects the execution phase where 'powershell.exe' is launched by 'schtasks.exe', reading a file from 'C:\ProgramData\VljE', and performing XOR decryption. A third selection identifies obfuscated PowerShell execution involving 'Invoke-Expression', text encoding, and XOR decryption. The rule triggers if either the task creation pattern is observed or if both the task execution and obfuscated execution patterns are observed.
This rule detects potential PyPI package impersonation attacks, specifically targeting packages that mimic 'sympy' and deliver cryptomining malware. It identifies suspicious package installation patterns, including the use of custom index URLs or extra index URLs, and the presence of specific installation flags like '--no-deps', '--no-cache-dir', or '--force-reinstall' in conjunction with 'sympy' related package names. Additionally, it looks for suspicious Python execution patterns involving code that imports, executes, or evaluates base64-encoded data, often associated with network communication libraries (urllib, requests, http.client, socket). The rule combines these indicators to identify malicious activity related to cryptomining malware delivered via PyPI.
This rule set detects Go-compiled DLLs exhibiting characteristics often associated with spyware. The rules look for a combination of indicators including: specific build IDs and strings, suspicious Go package structures (e.g., 'considerations/'), obfuscated Go function names (e.g., 'main.main.candidateazerbaijanassessments' and regex patterns for long, random-looking function names), obfuscated Go structure names (e.g., 'main.Associatesstructure'), and suspicious communication/encryption-related strings (e.g., 'communication_key', 'ENCRYPTED_COMMAND', 'QUANTUM_ENCRYPTED'). The rules collectively aim to identify malicious Go DLLs that attempt to hide their functionality through obfuscation and use specific patterns for command and control or data exfiltration.
Detects Remcos RAT payloads and commands
Page 93 of 98