Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
3
Products / Services
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects a file with a .mp5 extension in the /tmp directory being made executable via chmod. This technique was used by a stager to deliver the Rekoobe backdoor by masquerading ELF binaries as media files to evade detection.
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of the attacker attempting to stop the AppArmor network security service on devices running Linux.
This YARA rule detects the GTPDOOR backdoor by identifying specific byte patterns within its code. The rule includes two main detection blocks, one for 'v1' and another for 'v2' versions of the backdoor, each looking for distinct functions related to sending results to a peer, executing remote commands, sending replies, and checking if the daemon is already running. The 'v1' block specifically targets functions like 'send_result_to_peer_v1_p*', 'execute_remote_command_v1', 'send_reply_v1_p*', and 'daemon_already_running_check_v1'. The 'v2' block targets 'send_result_to_peer_v2_p*', 'execute_remote_command_v2', and 'main_routine_v2_p*'. The rule also ensures the file is an ELF executable by checking the magic bytes at the beginning of the file.
