Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
17
9
7
1
1
Contributors
7
5
4
4
3
Categories
16
13
9
6
4
Platforms
28
3
3
3
1
Products / Services
12
6
4
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of processes whose SHA256 hash matches a known hash associated with the MOONRISE RAT malware. It queries DeviceProcessEvents for the last 24 hours and filters for processes with matching SHA256 hashes.
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects the download of the Amnesia RAT payload from a specific Dropbox URL observed in a multi-stage malware campaign.
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
KQL Query
KQL Query from file: Hunting NonEuclid RAT
KQL Query
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
This rule detects the execution of NetSupport RAT, specifically looking for instances where the 'client32.exe' component has been renamed. It identifies the RAT by checking for specific product strings ('NetSupport Remote Control'), original file names ('client32.exe'), or a known Imphash (A9D50692E95B79723F3E76FCF70D023E). The rule explicitly excludes legitimate executions of 'client32.exe' to focus on renamed instances, indicating an attempt at defense evasion.
Detects the execution of 'rundll32.exe' by a 'svchost.exe' process, specifically when the 'svchost.exe' is running with command-line arguments associated with the ColdSteel RAT persistence mechanism (e.g., '-k msupdate', '-k msupdate2', '-k alg'). The 'rundll32.exe' process further executes specific functions ('UpdateDriverForPlugAndPlayDevicesW', 'ServiceMain', 'DiUninstallDevice') which are indicative of the ColdSteel RAT's cleanup or operational commands. This behavior is noted to be specific to certain ColdSteel RAT samples and not present in older versions.
Detects the creation of a new user profile in the Windows Registry with specific usernames ('ANONYMOUS' or '_DomainUser_') within the ProfileList, which has been observed in some variants of the COLDSTEEL RAT malware. This indicates potential persistence or privilege escalation attempts by creating a new user account.
Detects the creation of an 'svchost.exe' process with specific command line flags ('-k msupdate', '-k msupdate2', or '-k alg') that have been observed in use by the ColdSteel RAT for persistence and defense evasion. This pattern indicates the RAT establishing itself as a service to maintain access on a compromised system.
Page 2 of 2