Daniel Jeremiah
@daniyyellUnited KingdomTrusted contributorCompletionist
8 followers4,598 downloads2,329 copies65 likes127,935 views
978 detections
Filters
Last updated
All Time
Detection languages
303
179
131
120
97
Categories
317
280
168
139
136
Platforms
669
130
98
61
39
Products / Services
112
54
50
48
38
MITRE Techniques
370
280
196
192
187
CVEs
35
7
4
4
4
IDS Classtypes
11
3
2
1
IDS Protocols
11
2
2
1
1
Detects Mirai botnet variants targeting ARM-based IoT devices, identifying specific filesystem access patterns, watchdog killer functionality, targeting of Busybox, and HTTP flood attack modules used in DDoS operations.
Detects UPX-packed Mirai botnet binaries targeting ARM architecture by identifying characteristic strings and ARM-specific markers.
Detects sophisticated browser fingerprint spoofing by Mirai variants aimed at evading bot detection systems.
Generic detection for MSI-based installer droppers.
Detects the installation of FleetDeck Agent RMM, possibly used for Remote Monitoring and Management abuse.
Detects decoy or variant executables with UPX-like strings but without standard UPX packing.
Detects FleetDeck Go-compiled installer by identifying Go build specifics and FleetDeck-related strings.
Detects the FleetDeck installer containing an embedded CAB payload.
This query detects the creation of local user accounts on Linux systems using the 'useradd' or 'adduser' commands. Monitoring for local account creation is crucial as adversaries may create accounts for persistence, privilege escalation, or to facilitate lateral movement.
Detects suspicious child processes of the PsExec service executable (PSEXESVC.exe). This activity could represent an adversary using PsExec for lateral movement and executing commands on a remote host.
Page 97 of 98