Danny Y
@zendannyyTrusted contributorCompletionist
3 followers3,372 downloads955 copies13 likes34,080 views
375 detections
Filters
Last updated
All Time
Detection languages
217
71
32
20
11
Categories
211
89
31
25
19
Platforms
169
148
32
12
9
Products / Services
57
49
47
14
12
MITRE Techniques
152
109
107
75
34
CVEs
2
1
1
1
1
This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.
Detects malicious activity related to the TCC.db, commonly abused by macOS malware to bypass Transparency, Consent, and Control (TCC) restrictions.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Detects unauthorized interactive modifications to CI/CD pipeline configurations that could indicate supply chain attack or malicious dependency code injection attempts.
Upx Packer
YARA
Generic detection for UPX packer
The following detects interactive shell execution within a container in a production K8s namespace.
This could be indicative of an attacker with a compromised user account attempting to control a container.
This could be indicative of an attacker with a compromised user account attempting to control a container.
Strings based rule for burntcigar malware
Detects an adversary stopping or killing the syslog daemon (syslog,
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
Detects deleting of K8s log events. Indicating Defense Evasion tactics, and covering of tracks.
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
Page 36 of 38