Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,082 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Detects network connections to a suspicious Vercel application URL ('vscode-ext-git.vercel.app') combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential ingress tool transfer or data exfiltration attempts.
Detects network connections to a suspicious Vercel application URL combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential data exfiltration attempts as noted in the linked blog post.
Detects outbound HTTP POST requests using a specific, hardcoded Internet Explorer 8 User-Agent string over a specific port. This combination is highly indicative of the cross-platform RAT deployed via the compromised Axios npm packages.
Detects the installation or execution of compromised npm packages related to the Axios supply chain attack, with execution or reference to the dropped macOS RAT payload.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
Detects wscript.exe or cscript.exe spawning cmd.exe to decompress a specific archive using the built-in Windows tar utility. This staging behavior is used by the PyLangGhost VBScript loader to unpack required library files before executing the RAT payload associated with NICKEL ALLEY campaigns.
This rule detects the use of the `useradd` command on Linux systems with options that grant elevated privileges or modify user home directory creation. Specifically, it looks for the creation of users with UID or GID 0 (root privileges), or options that prevent home directory creation (`--no-create-home` or `-M`), which can be indicative of malicious user account creation for persistence or privilege escalation.
Detects network connections initiated by regsvr32.exe or cmstp.exe to external IP addresses on common web ports. This behavior can indicate the use of these legitimate Windows utilities for malicious purposes, such as downloading and executing malicious scripts or DLLs, often bypassing application whitelisting.
Detects the execution of cmstp.exe with command-line arguments indicative of installing or registering components via an INF file. This behavior is often abused by adversaries for proxy execution, UAC bypass, or application control bypass.
Page 24 of 38