nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,832 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
This rule detects network connections using the Generic Routing Encapsulation (GRE) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration to bypass network filtering.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an AppData directory.
Detects the creation of executable or script files by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a drive-by download, a malicious attachment being saved, or other forms of initial access where an attacker leverages a user's interaction with these applications to drop malicious payloads.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet. This behavior can be indicative of malicious activity, as 'Cursor.exe' is not typically associated with network communication or file downloads.
This rule detects suspicious usage of Windows Script Host (wscript.exe or cscript.exe) by monitoring for the execution of VBScript files containing keyword-heavy command lines related to common phishing themes (e.g., 'Invoice', 'Payment', 'Urgent'). It flags when a specific device executes three or more such scripts within a one-hour window, which is indicative of potential bulk file processing or automated malicious activity typical of dropper or downloader malware.
Detects multiple executions of WScript.exe or CScript.exe within a single hour on the same device where the command line arguments contain document-related keywords such as Invoice, Bill, or Payment, and the file extension ends in .vbs or .vbe. This pattern often indicates mass execution of malicious scripts often delivered via email attachments or phishing lures.
This YARA rule detects a specific PDB (Program Database) path associated with the SessionGate 7ZipDownloader malware. The presence of this string in a file indicates that the file is likely a component of the SessionGate malware, specifically its 7ZipDownloader module. PDB paths are often left in compiled binaries and can serve as unique indicators for specific malware families or development environments.
Page 39 of 70