New Detection Rules Feed

This YARA rule identifies the OrcaC2 stub, a component of a multi-functional C2 framework. Detection is based on a unique User-Agent string ('orca/1.0'), specific PDB file paths from the development environment, and a collection of status and error messages related to its WinHTTP communication and file handling functions. Relevant MITRE ATT&CK tactics: TA0011 Relevant MITRE ATT&CK techniques: T1071.001

malicious-activity command-and-control TA0011 T1071.001 MIT License

This YARA rule identifies the OrcaC2 Puppet component, a multi-functional C2 framework. The detection logic is based on the presence of hardcoded development paths and strings specific to the Puppet module, such as 'C:/Users/blood/Desktop/AAA/OrcaC2/', 'Orca_Puppet/pkg/', and 'OrcaC2_0H'. Relevant MITRE ATT&CK tactics: TA0011 Relevant MITRE ATT&CK techniques: T1071

malicious-activity command-and-control TA0011 T1071 MIT License

This KQL query evaluates the effectiveness of multiple open-source URL-based threat intelligence feeds. It ingests and unifies IOCs from sources like Botvrij, Monty Security, Phishunt, C2IntelFeeds, and others. The query then correlates these IOCs against EmailUrlInfo and EmailEvents data from the last 30 days to identify matches, helping to measure the real-world value and hit rate of each intelligence feed within the environment. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566.002

malicious-activity delivery TA0001 T1566.002

This KQL query evaluates the utility of threat intelligence feeds by correlating file hash IOCs with email attachments observed in the environment. It dynamically ingests SHA256 hashes from three public repositories: Bazaar Abuse.ch, botvrij.eu, and TweetFeed. The collected IOCs are then joined against EmailAttachmentInfo and EmailEvents tables in Microsoft Defender XDR to identify instances of known malicious files being delivered via email. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566.001

malicious-activity endpoint-security Kill Chain Phase: delivery TA0001 T1566.001

This YARA rule detects the ModeloRAT Python RAT, reportedly used by the KongTuke threat actor. The detection logic is based on the presence of three specific strings within a file. These strings include a unique cryptographic class name, 'UnnecessarilyProlongedCryptographicMechanismImplementationClass', and two function names, '_enumerate_executing_processes' and '_enumerate_network_connections', which indicate discovery capabilities. Relevant MITRE ATT&CK tactics: TA0007, TA0011 Relevant MITRE ATT&CK techniques: T1057, T1049

malicious-activity endpoint-security TA0007 TA0011 T1057 T1049

This YARA rule detects MintsLoader scripts by identifying a combination of characteristic strings. The logic targets scripts containing patterns such as the PowerShell command fragment 'Get-Date).DayOfYear', a common C2 URI structure ending in '.php?id=$', the use of '.top' top-level domains, and the '$global' variable string. A match is triggered if at least three of these four indicators are present, indicating the likely presence of the MintsLoader malware. Relevant MITRE ATT&CK tactics: TA0002, TA0011 Relevant MITRE ATT&CK techniques: T1059.001, T1071.001, T1105

malicious-activity endpoint-security TA0002 TA0011 T1059.001 T1071.001 T1105

This rule detects inbound email messages containing exactly one link to the 'breely.com' URL shortening service. The detection specifically triggers when the link's display text contains '.pdf', indicating an attempt to disguise a potentially malicious redirect as a PDF document to entice a user to click. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566.002

malicious-activity credential-access TA0001 T1566.002 MIT License

Detects inbound emails impersonating the Xodo Sign service. The rule triggers on messages containing the string 'processed by xodo sign' in the body, while also ensuring the sender is not from the legitimate 'eversign.com' root domain or that DMARC authentication has failed, to identify credential phishing attempts. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566

malicious-activity credential-access TA0001 T1566 MIT License

This rule detects callback scam language in inbound emails originating from the legitimate GetAccept service infrastructure. It leverages a Natural Language Understanding (NLU) classifier to identify intents associated with callback scams within the email body, flagging potential abuse of the GetAccept platform for fraudulent activities. Relevant MITRE ATT&CK tactics: TA0001 Relevant MITRE ATT&CK techniques: T1566, T1566.003

malicious-activity TA0001 T1566 T1566.003 MIT License

This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails. Relevant MITRE ATT&CK tactics: TA0001, TA0006 Relevant MITRE ATT&CK techniques: T1566, T1078

credential-access initial-access malicious-activity TA0001 TA0006 T1566 T1078