Rudra Verma
@RudravermaTrusted contributorCompletionist
3 followers269 downloads1,191 copies16 likes20,760 views
108 detections
Filters
Last updated
All Time
Detection languages
108
Categories
27
21
20
16
14
Platforms
61
39
9
7
6
Products / Services
34
18
17
15
4
MITRE Techniques
41
38
36
28
24
CVEs
2
2
1
1
This rule detects the installation and activation of the ClawdBot extension, likely within Visual Studio Code. It looks for the creation of specific files (extension.js, package.json, run.bat) within known VS Code extension paths and correlates this with the execution of 'Code.exe' or 'code.exe'. The rule specifically triggers when at least two of these files are found in the specified paths, indicating a potential extension installation.
Detects file operations involving known malicious hashes associated with a Notepad++ supply chain compromise. The rule identifies files with specific SHA1 hashes and provides contextual information such as action type, device name, file path, and initiating process details. The enhanced version further categorizes risk levels, enriches data with Notepad++ specific context, and aggregates events for a summary view, including threat metrics and prioritization for response actions.
This rule detects the execution of command-line interpreters (bash, powershell, cmd, python) that include commands for invoking expressions or downloading content (invoke-expression, curl, wget, Invoke-WebRequest) AND contain specific keywords associated with AI agents (moltbot, openclaw, clawdbot). This combination suggests an AI agent potentially executing arbitrary or malicious commands, possibly as a result of prompt injection or an unusual script execution scenario.
This rule detects the execution of suspicious Visual Studio Code extensions, specifically those associated with known malicious extensions like ClawBot. It identifies instances where the VS Code executable initiates a process with command-line arguments containing keywords related to these malicious extensions.
This rule detects the use of unauthorized Remote Monitoring and Management (RMM) tools by identifying network connections to RMM-related URLs that have not been observed in a baseline period (last 7 days) but are observed in the last hour. It specifically filters out connections to approved RMM domains and known initiating processes (like web browsers) to reduce false positives. The rule leverages an external list of RMM domains to identify suspicious activity.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
This rule detects network connections or DNS queries to a predefined list of malicious domains. These domains are likely associated with typosquatting or other malicious infrastructure used by adversaries.
This rule detects network connections to known Remote Monitoring and Management (RMM) tool domains initiated by `cmd.exe` or `powershell.exe`. This behavior can indicate the unauthorized use of RMM tools by an adversary to gain remote access and control over a compromised system. The rule specifically looks for successful network connections where the remote URL matches a URI from a curated list of RMM domains, and the initiating process is either `cmd.exe` or `powershell.exe`, excluding a specific bypass command line.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
This rule detects the deployment and potential abuse of Velociraptor, a DFIR (Digital Forensics and Incident Response) tool. It identifies Velociraptor by monitoring file creation/modification in common installation paths and for its executable name, process execution, and the creation of suspicious child processes (like PowerShell, cmd, curl, wget) by Velociraptor. The rule also attempts to correlate these activities to determine the severity of the detection, indicating potential post-exploitation activity.
Page 8 of 11