Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects a loader writing an encrypted data component and immediately querying hostname, processor, or volume identifiers used to derive a machine-specific decryption key. This behavior is indicative of malware, such as RokRAT, attempting to create a system-specific payload to evade detection or ensure persistence.
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
