Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
6
5
2
1
Contributors
6
4
2
2
Categories
11
6
4
2
2
Platforms
11
2
2
2
1
Products / Services
5
3
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Detects a banking trojan creating command, task, response, or queue files in an application-data directory for asynchronous remote control. The rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file name contains keywords like 'command', 'task', 'queue', 'response', or 'job' with extensions like json, dat, bin, or txt. Additionally, it checks if the file path is within an AppData or ProgramData directory and if the context process is named 'banana', 'client', 'update', or 'service' with an .exe extension.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
KQL Query
KQL Query from file: Hunting NonEuclid RAT