Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
14
6
2
1
1
Contributors
7
4
3
2
2
Categories
13
10
4
3
3
Platforms
21
4
2
1
1
Products / Services
8
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
This rule detects the Linux_Backdoor_Krasue malware. It identifies specific byte patterns within the executable that correspond to functions for switching servers, getting hostname information, starting server processes, sending encrypted data, and notifying the server. The rule also checks for the ELF magic number to ensure it's a Linux executable.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
Page 2 of 2