Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,600 downloads2,430 copies68 likes128,310 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects behavioral patterns
Detects RAT command structure
Detects native decryption library
Detects P2B Airdrop variant
Detects Auction delivery app variant
Detects VPN masquerading variant
Detects Cobalt Strike beacon loaders using direct syscall invocation to bypass EDR usermode hooks, commonly seen in Venoma, SysWhispers, and Hell's Gate implementations.
Detects Mirai botnet HTTP flood attack modules used for Layer 7 DDoS attacks through specific HTTP request patterns, user-agent spoofing, anti-detection headers, and IP spoofing techniques.
Detects Cobalt Strike beacon loaders using process hollowing and memory injection techniques, focusing on specific API calls associated with these actions.
Detects the ZinFoq Go-based post-exploitation implant. This rule identifies the binary based on a unique, hardcoded timestamp string used for its timestomping anti-forensics feature, along with other specific C2 artifacts.
Page 96 of 98