Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
2
Contributors
4
3
1
Categories
2
2
2
2
1
Platforms
8
MITRE Techniques
5
4
3
3
2
CVEs
71
71
64
58
49
Detects suspicious child process execution or AD reconnaissance commands launched by DbgView64.exe, which may indicate Backdoor.Turn activity associated with DragonForce.
Detects public outbound network connections initiated by DbgView64.exe, DbgView.exe, or VirtualBox.exe. This activity may indicate DragonForce Backdoor.Turn behavior, where the malware abuses legitimate Microsoft Teams TURN relay infrastructure to hide command and control traffic.
Detects suspicious image loads from DbgView64.exe outside standard Windows directories and known vulnerable driver loads associated with DragonForce Backdoor.Turn activity.
Detects loading of GameDriverx64.sys, which has been identified as a vulnerable driver (CVE-2025-61155) that can be exploited for kernel-level privilege escalation.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the execution of 'polers.dll' via rundll32.exe, a command-line pattern used by the Interlock ransomware group's 'Hotta Killer' tool to terminate security software by exploiting CVE-2025-61155.
Detects the creation or start of a Windows service with a name pattern 'UpdateCheckerX64_{random-numbers}'. This is a characteristic behavior of the 'Hotta Killer' tool used by the Interlock ransomware group to load a vulnerable driver (CVE-2025-61155) for disabling security products.
Detects the execution of 'polers.dll' via rundll32.exe, a command-line pattern used by the Interlock ransomware group's 'Hotta Killer' tool to terminate security software by exploiting CVE-2025-61155.