Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
2
1
1
Products / Services
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects a non-browser process launching a browser with automation flags, which subsequently connects to WhatsApp Web. This behavior is consistent with the Maverick banking trojan's use of Selenium and WPPConnect to hijack WhatsApp sessions for self-propagation.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
