Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
2
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
1
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
