Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
15
4
1
Contributors
10
2
2
1
1
Categories
10
8
8
6
5
Platforms
10
9
1
Products / Services
10
5
5
5
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects activity associated with the CARBONATO botnet, specifically the weaponization of the Hermes Agent framework. The detection monitors for the overwrite of the SOUL.md configuration file to inject a malicious GH0ST persona, execution of the hermes-agent binary from known malicious paths, and the presence of the CARBONATO_API_KEY environment variable or command-line parameter.
Detects periodic image file creation (e.g., .bmp, .png, .jpg) in user-writable temporary or application data directories by non-UI processes. This pattern is consistent with the behavior of remote access trojans (RATs) such as Atlas RAT and Gh0stRAT, which capture screenshots and stage them for exfiltration.
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects the loading of malicious DLLs (e.g., "propsys.dll", "batmeter.dll") by legitimate Windows binaries ("Fondue.exe", "mblctr.exe", etc.) from non-standard, user-writable locations.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
Detects the execution of legitimate Windows binaries with command-line arguments containing URL patterns. This is a technique used by the Dohdoor malware campaign to pass C2 information to a sideloaded malicious DLL.
This rule identifies various activities associated with the Dohdoor malware campaign, combining multiple detection heuristics into a single result set. It looks for PowerShell executing curl to download batch scripts, copied Windows tools run from shared folders with unusual arguments, suspicious DLL loads from shared folders, and network connections to C2-style domains identified in the campaign.
Detects the execution of legitimate Windows executables from non-standard public directories. This is a technique used by the Dohdoor malware to sideload a malicious DLL (e.g., propsys.dll, batmeter.dll).
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
