Arnold Chan
@slazTrusted contributorCompletionist
2 followers1,966 downloads3,574 copies44 likes20,345 views
7,399 detections
Filters
Last updated
All Time
Detection languages
5,494
1,006
394
169
98
Categories
2,311
1,792
1,178
1,003
910
Platforms
4,111
1,552
1,220
660
658
Products / Services
2,750
1,003
991
705
485
MITRE Techniques
2,072
1,500
1,388
1,065
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
Detects ERAAgent.exe performing suspicious dynamic API resolution for functions commonly used by the SLEEPWALKER malware (VirtualProtect, SetSecurityDescriptorDacl, and CryptGenRandom). By resolving these functions at runtime via GetProcAddress rather than including them in the static import table, the malware attempts to evade detection and analysis.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
This rule monitors the Windows Application event log for critical Microsoft SQL Server (MSSQL) events. It detects server crashes, access violations, stack overflows, and high-severity (20+) errors. These events often indicate severe database corruption, underlying system instability, or potential exploitation attempts targeting the database engine.
Detects Windows Internet Shortcut (.url) files that contain suspicious lures and direct users to Microsoft device code authentication endpoints (devicelogin), characteristic of ARToken phishing campaigns hosted on anonymous SharePoint shares.
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.
Detects the loading of compression libraries (such as lzma.dll or 7z.dll) by ERAAgent.exe followed by suspicious process or thread activity (e.g., remote thread creation, memory allocation). This pattern is often associated with the staging and execution of malicious payloads in memory.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
Page 734 of 740