Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
3
1
Platforms
3
MITRE Techniques
18,181
15,741
12,668
8,483
6,296
ZxShell Malware
Sigma
Detects a ZxShell start by the called and well-known function name
ZxShell Malware
Sigma
Detects a ZxShell start by the called and well-known function name
This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.
