Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
11
7
7
5
2
Contributors
12
5
5
5
3
Categories
13
11
10
10
9
Platforms
29
3
1
1
Products / Services
14
10
8
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects network connections initiated by unsigned executables that were recently created (within one hour) in common staging directories such as AppData, Temp, or ProgramData. It specifically targets beacons to the Telegram Bot API or Discord webhooks, which are common patterns for command-and-control (C2) communication used by malware such as the Amadey bot.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
This Suricata rule detects potential exfiltration of stolen data by the StealC or Amadey malware families. It specifically looks for an HTTP POST request to a .php URI containing a 'PK' header (the magic bytes for a ZIP file), suggesting the transmission of compressed stolen logs to a C2 server.
Detects the use of living-off-the-land binaries (LOLBins) such as PowerShell, curl, certutil, bitsadmin, or mshta to download potential secondary payloads from self-hosted GitLab instances. This behavior is indicative of the Amadey loader chain, where compromised GitLab infrastructure is used as a repository to stage and distribute StealC or other malicious payloads.
Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).
Detects the use of WMI (via WmiPrvSE.exe or wmic.exe) to enumerate or terminate PowerShell processes. This behavior is indicative of the Amadey/StealC delivery chain, where a JScript dropper uses WMI to clean up script execution artifacts after a specified timeout, aiding in defense evasion.
Detects persistence attempts by the Amadey infostealer. The rule monitors for unauthorized creation of .job files directly in the Windows Tasks directory or the execution of schtasks.exe from suspicious locations such as TEMP or APPDATA folders.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Detects suspicious screen capture activity by non-UI processes. This rule identifies instances where a process invokes GDI BitBlt/PrintWindow or CopyFromScreen APIs, followed by writing a JPEG screenshot file to disk, particularly from temporary or program data folders. This behavior is consistent with infostealers like StealC and Amadey.
Detects HTTP GET requests to a specific self-hosted GitLab domain 'gitlab.bzctoons.net' that attempt to download a file named 'protected.zip', which is associated with the retrieval of StealC information-stealing malware by the Amadey loader.
Detects a specific command-line pattern used by the Amadey loader to perform self-relocation. The process chain executed via cmd.exe includes 'taskkill', 'timeout', 'del', and 'ren' in a single command line to terminate, delete, rename, and relaunch its executable from a user-writable directory to maintain persistence and evade detection.
Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.
Detects signs of post-infection activity from the Amadey malware, specifically the unauthorized enabling of Remote Desktop Protocol (RDP) via registry modifications, the use of tscon.exe for session hijacking, unusual execution of RDP-related binaries (mstsc.exe, rdpclip.exe), and the deployment of legitimate remote access tools like AnyDesk or TeamViewer for lateral movement.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.
This rule detects the presence of Blackbeard malware by identifying known SHA256 hashes of its components or network connections to its known C2 infrastructure. It correlates file events with specific hashes and network events with specific remote IP addresses.
Page 1 of 2