Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
22
1
Contributors
20
2
1
Categories
22
2
2
2
2
Platforms
23
2
Products / Services
5
4
2
2
2
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Page 1 of 2