Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
15
6
2
2
1
Contributors
6
6
4
3
3
Categories
16
9
9
5
3
Platforms
22
3
3
2
2
Products / Services
8
6
5
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
Detects a banking trojan process establishing TLS communication immediately after loading input, capture, and overlay modules. The rule specifically looks for network connections initiated by processes with names like 'banana', 'client', 'update', 'service', or 'host' (case-insensitive) and command lines indicating SSL/TLS communication or remote control functionality.
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Detects a banking trojan creating command, task, response, or queue files in an application-data directory for asynchronous remote control. The rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file name contains keywords like 'command', 'task', 'queue', 'response', or 'job' with extensions like json, dat, bin, or txt. Additionally, it checks if the file path is within an AppData or ProgramData directory and if the context process is named 'banana', 'client', 'update', or 'service' with an .exe extension.
Detects DC-RAT by matching complete static API/function and string fingerprint.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
Detects DC-RAT by matching complete static API/function and string fingerprint.
Detects Microsoft Teams messages containing links to Pastebin. Threat actors (e.g., Nimbus RAT operators) use Pastebin to host instruction checklists and payload URLs during vishing attacks.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
This rule detects the creation of a scheduled task named 'MicrosoftSystem64' using various methods. It looks for command-line execution of 'schtasks.exe /create' with the specific task name, explicit ScheduledTaskCreated events from Microsoft Defender for Endpoint (MDE) containing 'MicrosoftSystem64', and Windows Security Event ID 4698 (Scheduled Task Created) where the TaskName contains 'MicrosoftSystem64'. This specific task name is associated with known threat actor activity, particularly FAMOUS CHOLLIMA / DPRK-linked actors deploying Node.js SEA RAT.
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
This detection identifies instances where rundll32.exe is used to load a DLL from a temporary directory, such as C:\Users\<User>\AppData\Local\Temp\ or C:\Windows\Temp\. While rundll32.exe is a legitimate Windows utility used to execute functions exported from DLLs, its use to load libraries from temporary locations is highly suspicious. These directories are commonly used by malware and red team tools to stage payloads or execute code in-memory without writing it to more persistent locations. This behavior often indicates defense evasion, initial access, or privilege escalation, especially when the DLL is unsigned, recently written, or executed shortly after download. In normal user workflows, DLLs are not typically loaded from Temp paths, making this a high-fidelity indicator of potentially malicious activity. Monitoring this pattern is essential for detecting threats that attempt to blend in with native system processes while bypassing traditional application controls.
KQL Query
KQL Query from file: Hunting NonEuclid RAT
Page 1 of 2