Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
7
1
1
1
Contributors
3
3
1
1
1
Categories
4
4
4
3
2
Platforms
9
1
Products / Services
5
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
Detects command-line execution containing keywords associated with Guloader (e.g., 'guloader', 'gupl') or generic download indicators (e.g., 'download' combined with protocol identifiers like 'http', 'https', 'ftp'). This typically indicates the malicious downloading of payloads by the Guloader malware family.
This rule detects the execution of PowerShell, wscript, or cscript with command-line arguments containing "Invoke-WebRequest" or "curl" in conjunction with specific keywords like "guloader", "etherhiding", or "clickfix". This combination suggests an attempt to download or execute malicious payloads associated with these campaigns or malware families.
Detects file names associated with the Guloader Performance Report Pretext campaign.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
Detects the execution of GuLoader malware where a rundll32.exe process is spawned by an injected browser process (chrome.exe, firefox.exe, or msedge.exe). This behavior indicates potential malware activity, specifically GuLoader initiating network connections.
KQL Query from file: Hunting Zloader DNS Tunneling
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
ZLoader was delivered in a campaign in summer 2021 via malvertising. This campaign was tweeted about by @MsftSecIntel on twitter.
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.