Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
3
2
1
1
1
Platforms
2
1
Products / Services
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects InterlockRAT activity by identifying Java runtime executions (java.exe or javaw.exe) that include the '-jar' argument and originate from suspicious folders like AppData\Local\Temp, ProgramData, or Public. InterlockRAT is known to leverage Java runtimes to establish persistent SOCKS5 tunnels and reverse shells.
Detects the execution of the Supper SOCKS5 backdoor, used by the Vanilla Tempest threat actor, based on a unique command-line pattern involving DllRegisterServer and a .ULB file, which acts as a loader for the obfuscated payload.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
