Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
12
10
Contributors
18
2
2
Categories
10
10
10
8
8
Platforms
12
10
Products / Services
12
12
9
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
IDS Classtypes
8
4
IDS Protocols
8
4
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detects potential Casbaneiro banking trojan activity characterized by a user accessing a known Latin American banking domain via a web browser, followed within 10 minutes by a suspicious process (RegSvcs.exe or mobsync.exe) establishing an outbound network connection, which is consistent with command-and-control (C2) behavior often seen in this malware family.
Detects network beaconing activity associated with the Casbaneiro (Metamorfo) banking trojan. The rule monitors for specific C2 communication patterns, including the 'client;' string and the 'VVx-4.3' version marker, which are characteristic of this malware's host reconnaissance and command-and-control exfiltration phase.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detects concurrent creation of a hexadecimal-named folder in the %TEMP% directory and a corresponding registry key in HKCU\SOFTWARE, both named with the same MD5 hash. This specific behavior is a known indicator of Casbaneiro (also known as Metamorfo) banking trojan infection, where the malware uses these locations to stage components and achieve persistence.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Page 1 of 2