nomit vyas
@xoxoTrusted contributorCompletionist
4 followers1,278 downloads993 copies13 likes36,821 views
694 detections
Filters
Last updated
All Time
Detection languages
356
151
63
46
45
Categories
237
204
109
106
102
Platforms
469
83
62
48
41
Products / Services
192
50
41
39
22
MITRE Techniques
253
215
154
142
138
CVEs
3
3
3
3
3
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
1
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions from a single device within an hour is flagged, indicating potential malicious activity like phishing or malware delivery.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
This rule detects suspicious execution of VBScript (.vbs or .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. A high count (3 or more) of such events from a single device within an hour is flagged to reduce false positives.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects DC-RAT by matching complete static API/function and string fingerprint.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads.
Page 46 of 70