Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
8
1
1
Contributors
5
4
1
Categories
8
7
6
3
2
Platforms
10
Products / Services
7
1
1
1
MITRE Techniques
18,154
15,694
12,637
8,448
6,267
This rule detects potential Quasar RAT post-infection activity by correlating the identification of keystroke logging API usage (specifically SetWindowsHookEx, GetAsyncKeyState, or GetKeyboardState) followed by an outbound network connection from the same process identifier within a ten-minute window, indicative of remote control functionality.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the presence of QuasarRAT-related processes combined with the creation of known log filenames associated with its keylogging functionality.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the historical HPlus HTS fraud infrastructure chain. The rule monitors for the reading of a configuration file named 'config.Ini', followed by an outbound FTP connection (port 21), and the subsequent launch of an executable, which is indicative of a Quasar RAT deployment sequence.
Detects execution of processes associated with QuasarRAT or references to its configuration files, originating from or involving files and processes named 'UBPUpdater.exe' or 'UBPPatch.Psh'. Also identifies network connections via FTP or involving configuration files ('config.Ini') initiated by these specific processes, which may indicate malicious activity, command and control, or data exfiltration.
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
