Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
17
9
7
1
1
Contributors
7
5
4
4
3
Categories
16
13
9
6
4
Platforms
28
3
3
3
1
Products / Services
12
6
4
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Detects a banking trojan creating command, task, response, or queue files in an application-data directory for asynchronous remote control. The rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file name contains keywords like 'command', 'task', 'queue', 'response', or 'job' with extensions like json, dat, bin, or txt. Additionally, it checks if the file path is within an AppData or ProgramData directory and if the context process is named 'banana', 'client', 'update', or 'service' with an .exe extension.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
Detects network traffic to the specific 'amos-trading' Bitbucket repository used by a threat actor to host trojanized STX RAT installers. This activity is indicative of a supply chain compromise where malicious software is distributed via a legitimate-looking source.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects CrystalX-style browser clipper behavior when specific command-line patterns (CDP or clipper commands) appear in conjunction with a CrystalX temporary payload lineage. The temporary payload is identified by an executable named 'svc' followed by 3 to 6 digits, located in the user's AppData\Local\Temp directory.
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
Page 1 of 2