Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
209 detections
Filters
Last updated
All Time
Detection languages
101
29
22
22
16
Contributors
81
65
23
11
7
Categories
116
60
50
46
38
Platforms
202
6
3
1
Products / Services
102
62
25
19
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the loading of a DLL using the regsvr32 application with the silent parameter and DLLInstall execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process command-line arguments and parent process details. This activity is significant as it is commonly used by RAT malware like Remcos and njRAT to load malicious DLLs on compromised machines. If confirmed malicious, this technique could allow attackers to execute arbitrary code, maintain persistence, and further compromise the system.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
Detects indicators of Remcos RAT activity, specifically focusing on its use of native Windows utilities like attrib.exe, icacls.exe, and cmd.exe to modify file attributes, alter access control lists, or facilitate self-deletion. The rule also triggers when a identified Remcos-related process directly spawns these administrative tools for evasive actions.
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
Detects potential exploitation of CVE-2017-0199 where Microsoft Office applications (winword.exe or eqnedt32.exe) spawn suspicious child processes (mshta.exe, wscript.exe, cscript.exe, powershell.exe, or cmd.exe) often associated with malicious document-based payloads like Remcos RAT. The rule monitors for both process spawning patterns and command-line arguments indicative of remote payload retrieval.
Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
Detects potential malicious activity where a process enumerates installed software by querying the Windows Uninstall registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall) for application details such as DisplayName, Publisher, and UninstallString. This pattern is characteristic of Remcos RAT's 'ListInstalledApplications' capability to perform reconnaissance on a compromised host.
Detects modifications to Windows Registry Run keys that specify paths associated with Remcos remote access tool (RAT) binaries. This behavior is used by the malware to achieve persistence by automatically launching the malicious process upon user logon.
This rule detects the use of 'reg.exe' to disable User Account Control (UAC) by setting the 'EnableLUA' registry key to '0'. This action is a common technique used by malware, such as the Remcos RAT, or by adversaries attempting to persist with elevated privileges by weakening Windows security controls.
This rule detects network connections on non-standard ports (2404, 4782) that are commonly associated with the Remcos Remote Access Trojan (RAT). It monitors outbound connections from suspicious process names or paths, such as those found in ProgramData, AppData, or Temp directories, and filters out internal RFC-1918 traffic.
Detects the execution of command shells (cmd, powershell, pwsh) spawned by the Remcos Remote Access Trojan (RAT), typically located in ProgramData or executing as remcos.exe. The rule monitors for command-line arguments indicative of script execution.
Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.
Detects Remcos RAT-related User Account Control (UAC) bypass activity. The rule identifies suspicious process creation and cross-process patterns where non-Microsoft signed executables, specifically those often masquerading as explorer.exe or interacting with system-level binaries (e.g., iexplore.exe, svchost.exe, fsutil.exe), attempt to elevate privileges using COM interfaces such as CMSTPLUA.
Detects potential Remcos RAT activity utilizing the CMSTPLUA COM interface for UAC bypass. The rule identifies instances where suspicious processes (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed from non-standard locations such as ProgramData, AppData, or Temp folders, which is characteristic of Remcos execution flows.
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects Remcos RAT using process hollowing to inject into the default browser executable. The loader chain originates from a TuglaInsaatci-masquerading executable and passes through in-memory DLL stages (Optimax.dll / System Optimizer Ultimate.dll) before hollowing the browser. The Remcos_Mutex_Inj mutex confirms successful injection into the browser process.
Page 1 of 10