nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,832 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' which often signifies communication with a C2 server using a specific API endpoint and a GUID-like identifier.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the referenced Check Point research.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, indicating potential malicious activity like phishing or malware delivery.
Identifies command-line arguments that involve both a Markdown (.md) file and a suspicious URI scheme. This could indicate an attempt to exploit CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
Page 37 of 70