Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
Platforms
2
Products / Services
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the creation of a mutex with a pattern matching new SmokeLoader versions (2025 alpha and 2025). The malware's main module is injected into explorer.exe, which then creates this distinct mutex to prevent multiple instances from running.
This is a query to retrieve last 30 days network connections to known Dofoil NameCoin servers.
The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp.
The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp.
