100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,392 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
This rule detects Portable Executable (PE) files that masquerade as PDF documents by embedding specific PDF-themed icons. The rule checks for the standard PE file magic bytes and then hashes the first resource (typically the icon) of the PE file. If the hash matches any of the known hashes for PDF red icons, it triggers an alert. This technique is commonly used by attackers to trick users into executing malicious files that appear to be benign PDF documents.
This rule detects the SugarWraith loader DLL, which is associated with the UNK_SweetSpector threat group. It identifies the malware based on a combination of specific strings found within the binary, including error messages related to process and pipe creation, system information gathering strings, and network-related strings like "ngrok-skip-browser-warning" and "SecureProtocols". The presence of at least four of these strings indicates the potential presence of the SugarWraith loader.
This rule identifies a specific NMAP executable by checking its PE header characteristics and MD5 hash. It looks for a 32-bit executable (pe.machine == pe.MACHINE_I386), a specific MD5 hash value ("bd457e3fb19a7f127a23369e70ee84fc"), a major linker version of 6, and a section named ".rdata" at index 1. This is intended to confirm if a file is a legitimate, specific version of the NMAP executable.
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
This rule detects HTML content that is structured to resemble an imageless QR code, typically rendered using an HTML table. It looks for the presence of both black and white color definitions (hex codes #FFFFFF and #000000) in conjunction with HTML table tags (<table> or <td) and color styling attributes (background-color: or color:). This technique can be used for obfuscation or to embed data in a way that might bypass traditional image-based QR code detection.
This rule detects elements commonly found in 3AM ransomware notes. It looks for the strings "threeam" or "3 am", a specific onion URL pattern associated with 3AM ransomware (e.g., http://threeam[0-9,a-z]*.onion or http://3am[0-9,a-z]*.onion), and at least one of the keywords "encrypted", "data", or "payment". The combination of these indicators suggests the presence of a 3AM ransomware note, likely indicating a ransomware infection or an attempt to communicate ransom demands.
Page 5 of 5