100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,392 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
This rule detects attempts to obfuscate the `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` registry key path by inserting various special characters between the letters. This technique is often used by malware to establish persistence and evade detection.
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.
This rule detects the Cruloader malware based on specific strings found within its binaries. The first rule, 'Loader_Cruloader_Strings', identifies the malware by looking for an RC4 key, a ROT13 charset, and the string "cruloader" itself. The second rule, 'Loader_Cruloader_Crypto', identifies the malware by looking for specific byte patterns indicative of its cryptographic routines, likely related to its RC4 implementation.
These rules detect encrypted ZIP files that contain only a single entry. The rules further specialize to detect if that single entry is a VBScript (.vbs) or Microsoft Management Console (.msc) file. This pattern is often used by adversaries to deliver malicious payloads, bypassing email security solutions that might not scan encrypted archives or might not recognize the malicious intent of single-entry archives containing specific script or configuration file types.
Detects the usage of the Windows native Cipher tool within PowerShell or cmd.exe to wipe the contents of the C Drive. The rule specifically looks for the 'cipher /W:C' command, which is used to remove data from available unused disk space on the C: drive, making previously deleted data unrecoverable.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects the presence of source code files associated with the Suterusu Rootkit. It looks for specific function definitions ('hijack_start', 'hijack_pause', 'hijack_resume', 'hijack_stop') typically found in 'common.h', print strings related to rootkit functionality ('Dropping to root shell', 'Hiding TCPv4 port %hu', 'Unhiding TCPv6 port %hu', 'Enabling module loading', 'Silently prohibiting module loading') from 'sock.c', and a define statement ('#define SUTERUSU_INIT_WORK') from 'dlexec.c'. The rule triggers if at least three of the function definitions are found, or any of the print strings, or the define statement.
This rule detects attempts to exploit CVE-2023-23752 in Joomla. The exploit involves unauthenticated access to sensitive configuration information or user data via specific API endpoints. The rule looks for HTTP GET requests to '/api/index.php/v1/users?public=true' or '/api/index.php/v1/config/application?public=true' followed by a 200 HTTP status code, indicating a successful information disclosure.
This rule detects macOS malware associated with the North Korean threat actor group CitrineSleet (also known as AppleJeus or UNK_JuiceHead). It specifically identifies binaries that exhibit consistent Dylib and Entitlement usage patterns observed in variants like UpdateAgent, SimpleTea (aka POOLRAT), and CrashReporter. The detection is based on matching specific hashes for the dylib and entitlement sections within Mach-O executable files.
Page 4 of 5