Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
This rule detects the use of .NET deserialization gadgets, often associated with malware loaders like Remcos RAT, by monitoring process command lines for specific keywords such as 'ObjectInputStream', 'DeserializeObject', 'BinaryFormatter', or 'NetDataContractSerializer'. It further refines detection by looking for processes with file names starting with 'GST' or specifically 'Optimax.dll', which are indicators of the Remcos loader.
Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
Detects weaponized LNK shortcut execution where native Windows tools (more, type, findstr) are abused to carve out and execute specific line-range payloads hidden inside decoy PDF containers.
Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).
Detects network traffic associated with the Meow backdoor's beaconing activity. Specifically, it looks for outbound network connections on port 666 initiated by 'rundll32.exe'. This pattern is indicative of malware using a common system utility to establish command and control communications.
Detects the creation of a potentially malicious 'index.js' file within a suspicious application data folder, specifically targeting the 'SuperMaxionQuickMaxlite' directory. This pattern is often associated with Electron-based malware or modified legitimate applications.
Detects network connections to the '/avast_update' endpoint, which is associated with the RMMProject malware for fetching secondary DLL payloads.
Detects the creation of the XWorm specific mutex 'HOHE6S8FaZZlGf0f'. This mutex is known to be used by the XWorm malware to ensure only a single instance of itself is running on a system.
Detects the execution of 'node.exe' with 'Update.js' in its command line. This pattern is associated with the primary dropper for the 'Lorem Ipsum' malware.
Detects the creation of a file named 'svchost.log' in a randomly named subdirectory within 'AppData\Local', which is indicative of EtherRAT malware storing its base64 encoded JSON configuration.
Page 133 of 232