Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
2
1
1
1
Platforms
1
1
Products / Services
1
1
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
This rule detects the creation of a process named 'conhost.exe' with 'System' integrity level, where the initiating process is an executable file with low global prevalence. This behavior can be indicative of malicious activity, as adversaries might use conhost.exe to execute commands or maintain persistence, especially when launched by an uncommon or suspicious executable.
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
