Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
2
2
1
Categories
2
2
1
1
1
Platforms
5
Products / Services
3
2
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
The following analytic detects the execution of the Windows command line to log off a host machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes involving `shutdown.exe` with specific parameters. This activity is significant as it is often associated with Advanced Persistent Threats (APTs) and Remote Access Trojans (RATs) like dcrat, which use this technique to disrupt operations, aid in system destruction, or inhibit recovery. If confirmed malicious, this could lead to system downtime, data loss, or hindered incident response efforts.
Detects the execution of javaw.exe from an AppData folder, which is a known behavior of Adwind RAT (also known as jRAT). Additionally, it detects the execution of cscript.exe with specific command-line arguments related to 'Retrive.vbs', which could indicate further malicious activity or a different variant/stage of the attack.
Detects the creation of specific file artifacts associated with Adwind RAT (also known as jRAT). This includes 'javaw.exe' within the AppData\Roaming\Oracle\bin\java directory and '.vbs' files within a '\Retrive' directory, both known indicators of Adwind/jRAT activity.