nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824). Specifically looks for HTML image tags (<img src=), the variable '$TITLE', or the Bing SSRF endpoint 'bing.com/images/searchbyimage' within the URL-decoded 'q' parameter.
This rule detects the launch of a process where its command line contains references to 'RawWNPF' or '\device\rawwnpf'. This pattern is often associated with malicious activity, specifically related to the 'Fishmonger's Arsenal' campaign and the 'SprySocks' malware, which utilize RawWNPF for inter-process communication or other low-level operations. The rule focuses on capturing the principal and target context for further correlation and investigation.
This rule detects network connections or URL clicks to a list of known malicious domains often associated with phishing or malware distribution. The rule specifically looks for connections to these domains combined with certain URL paths, or direct URL clicks to these domains.
Detects instances where 'node.exe' executes 'protocal.cjs' from 'NodePackages' paths, subsequently spawning child processes that perform host reconnaissance activities. This includes PowerShell commands querying registry keys related to installed software or listing applications.
This rule detects an ICMP ping sweep, which is a common technique used for host discovery within a network. It triggers an alert if more than 20 ICMP echo requests (type 8) are observed from a single source IP within a 10-second window, targeting the home network. This behavior is indicative of an attacker attempting to map out active hosts on the network.
Page 14 of 70