Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
16
8
2
1
Contributors
10
5
4
3
2
Categories
10
8
5
5
4
Platforms
21
2
2
2
1
Products / Services
8
4
4
2
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Commodity .NET keylogger and remote access trojan
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Commodity .NET keylogger and remote access trojan
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects emails containing archive file attachments (zip, rar, 7z). It summarizes the count of such archives per sender, recipient, and file name over a daily period. The rule specifically looks for instances where at least one archive is present in an email.
Detects the creation or modification of specific LaunchAgent plist files used by the arm64 and x86_64 variants of SStar Agent malware on macOS for persistence. The rule looks for file events (creation, modification, rename) within the /Library/LaunchAgents/ directory, specifically targeting 'com.wpnuersvc.agent.plist' and 'com.googleupdate.sstaragent.plist' filenames.
Detects the creation or modification of an executable named 'GoogleUpdateService.exe' within a user's Windows Startup folder. This activity is indicative of the SStar Agent malware establishing persistence, as it masquerades as a legitimate Google update service but uses an atypical persistence mechanism (Startup folder instead of Scheduled Tasks or Registry Run keys).
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects emails containing archive file attachments (zip, rar, 7z). It summarizes the count of such archives per sender, recipient, and file name over a daily period. The rule specifically looks for instances where at least one archive is present in an email.
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
Detects Office applications spawning scripting engines or LOLBINs often used in multi stage delivery chains associated with Agent Tesla style campaigns.
Detects execution of a suspicious payload from common staging locations used in multi stage campaigns.
Detects the execution of legitimate .NET framework utilities (Aspnet_compiler.exe, RegAsm.exe, vbc.exe) launched by scripting engines like PowerShell or WScript. This behavior is a known TTP for process hollowing, as seen in Agent Tesla campaigns, where malware injects its code into a trusted process to evade defenses.
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.
Detects registry modifications that disable internal tools or functions in explorer, a technique often used by malware like Agent Tesla to hinder user interaction or hide malicious activities.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
Page 1 of 2