Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
1
1
Contributors
4
1
1
1
1
Categories
3
2
2
2
2
Platforms
7
2
Products / Services
6
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the creation or execution of files matching known malicious SHA256 hashes associated with a weaponized ScreenConnect installer and a Rust-based loader. This rule identifies the presence of specific known malicious binaries on endpoints.
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.
KQL Query from file: Hunting Zloader DNS Tunneling
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
The following query surface network activity associated with exploitation of CVE-2022-22965.
ZLoader was delivered in a campaign in summer 2021 via malvertising. This campaign was tweeted about by @MsftSecIntel on twitter.
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.