Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects Windows Management Instrumentation (WMI) queries performed by wscript.exe that include specific reconnaissance-related keywords such as 'Win32_OperatingSystem', 'Win32_Process', 'LastBootUpTime', and 'PROCESSOR_ARCHITECTURE'. This activity is indicative of system reconnaissance, potentially by malware like Turla Kazuar v3 VBScript loader.
This rule detects command and control (C2) communication patterns associated with the BADAUDIO malware. Specifically, it looks for HTTP GET requests to known BADAUDIO C2 domains or Cloudflare Workers infrastructure. The detection logic focuses on the presence of specific cookie patterns ('Cookie: SSID=' or 'Cookie: cfuvid=') within the DestinationUrl, which BADAUDIO uses to exfiltrate encrypted system information. It also includes a specific URL path '/pub/static/img/merged' which might be used by the malware.
Detects network connections to Kazuar v3 command and control servers. The malware communicates with C2 infrastructure using HTTP/HTTPS protocols (ports 80/443) to any internet-routable IPv4 address. The loader uses WinHttp.WinHttpRequest.5.1 COM object for HTTP requests and ignores SSL certificate validation errors (SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056). File downloads are performed using ADODB.Stream, and User-Agent strings typically contain "WinHttp" or "ADODB" indicators. This rule matches any valid IPv4 address to account for the fact that Turla may use different C2 IPs across campaigns. The rule focuses on HTTP/HTTPS traffic which is the primary communication method used by the loader to download components and exfiltrate data.
Detects the registry-based persistence mechanism used by Turla's Kazuar v3 loader. The rule specifically looks for the creation or modification of a registry entry in 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' with the value name 'Hewlett Packard Drivers' and the data containing 'hpbprndi.exe'. This combination indicates the malware's attempt to masquerade as a legitimate HP printer driver for persistence across system reboots.
This rule detects potential APC injection techniques targeting explorer.exe, often associated with AsyncRAT. It looks for combinations of process injection API calls (QueueUserAPC, NtQueueApcThread, NtQueueApcThreadEx, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, NtCreateThreadEx) in conjunction with explorer.exe. Additionally, it includes a pattern to detect python.exe interacting with explorer.exe, which could indicate a multi-stage attack involving Python-based components.
This rule detects batch files associated with an AsyncRAT campaign. It identifies specific batch file names, PowerShell commands used for downloading malicious content, Python installation paths, and persistence mechanisms leveraging the Windows Startup folder. The rule looks for a combination of these indicators, such as specific batch file names, PowerShell download commands with output files, Python installation paths, or batch file names combined with startup folder persistence paths.
Detects EDR evasion techniques used by Cobalt Strike loaders, such as AMSI and ETW patching, and direct syscall patterns, aiming to evade security detections.
This rule detects the pkr_mtsi packer. It identifies memory allocation patterns (VirtualAlloc/ZwAllocateVirtualMemory), payload reconstruction from 8-byte chunks, LoadLibraryA resolution or DLL name finding loops, excessive payload write operations (>1000), GDI junk code calls (CreateSolidBrush), unpack routines for ASCII to wide string conversion, anti-debugging techniques (IsDebuggerPresent infinite loop traps), and hashing algorithms (Mul257 with signed add). It specifically targets PE files with more than 15 GDI32 imports and characteristic payload loading patterns.
Detects SecDelivery.apk - Kimsuky DOCSWAP variant
Detects network communication patterns
Page 95 of 98