Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
8
5
4
1
1
Contributors
13
5
1
1
Categories
7
5
4
4
3
Platforms
19
1
Products / Services
9
7
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects PE files exhibiting behavior consistent with LokiBot malware, specifically the use of a custom CRC32-variant hash function with a XOR polynomial of 0x4358AD54 for runtime API resolution. This technique is used to evade static import analysis by resolving Windows APIs dynamically via hashed identifiers.
This rule detects the presence of known LokiBot packed binaries by matching the SHA256 hashes of staged memory section bins that were recovered during unpacking analysis. This indicates a high-confidence match for known malicious samples associated with the LokiBot information stealer.
Detects HTTP traffic patterns associated with LokiBot malware beaconing to a hardcoded command and control (C2) endpoint. The rule specifically looks for established network connections to identified malicious domains or IP addresses using the /fre.php URI path.
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
Detects instances where Windows Script Host (wscript.exe or cscript.exe) spawns PowerShell or CMD. This pattern is commonly observed in malicious document loaders or script-based droppers, such as those associated with the LokiBot malware, which use JScript files to initiate secondary payload execution.
Detects the LokiBot information stealer establishing persistence via a Windows Run key. The detection looks for registry key modifications under HKCU that follow a specific pattern: the registry value points to an executable located within the %APPDATA% directory inside a short, six-character hexadecimal subdirectory. The rule further validates this behavior by monitoring for key names derived from the C2 infrastructure components, such as IP addresses or specific PHP script names, commonly observed in builder-generated LokiBot samples.
Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.
Detects the LokiBot malware attempting to resolve the 'CreateMutexW' API function at runtime using a specific hashed value (0xcf167df4). This technique is used by the malware to prevent multiple concurrent instances from running on the same host, which is a characteristic behavioral pattern for this information stealer.
Detects the LokiBot malware querying the 'MachineGuid' registry value located under 'HKLM\SOFTWARE\Microsoft\Cryptography'. This value is used by the malware to calculate an MD5 hash, which serves as a mutex name to ensure that only a single instance of the malicious process runs on the infected host.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects instances where a process executing from a user-writable directory (e.g., Temp, AppData) reads the HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid registry key. This behavior is a known technique utilized by the LokiBot information stealer to derive a host-specific mutex for tracking infections.
Detects the Visual Basic Compiler (vbc.exe) initiating DNS queries. This is highly anomalous behavior, as vbc.exe is a compiler and should not be making network connections. This technique is used by malware like Lokibot for defense evasion after process injection.
The analytic detects a process enabling the "SeDebugPrivilege" privilege token, leveraging Windows Security Event Logs with EventCode 4703. This privilege allows a process to inspect and modify the memory of other processes, which can lead to credential dumping or code injection. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, an attacker could gain extensive control over system processes, enabling privilege escalation, persistence, or access to sensitive information.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
The analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
The following analytic identifies processes running from %temp% directory file paths. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
This analytic identifies processes accessing Intelliform Storage Registry keys used by Internet Explorer, excluding legitimate Internet Explorer and dllhost processes. This activity is significant because it can indicate unauthorized access or manipulation of sensitive registry keys used for storing form data in Internet Explorer, potentially leading to data exfiltration, credential theft, or further system compromise.
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
