Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
17
13
1
1
1
Contributors
15
9
3
2
1
Categories
24
7
5
5
5
Platforms
23
9
3
1
1
Products / Services
7
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
This rule detects the Linux_Backdoor_WolfsBane malware based on specific byte patterns found in its code. The patterns correspond to functions for loading embedded libraries, decrypting embedded libraries, and removing the backdoor. The rule specifically targets ELF executables.
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
This rule detects the PygmyGoat backdoor on Linux systems by identifying specific byte patterns associated with its functionality. The patterns include code for creating backdoor sockets, forwarding data, the main constructor, and hooking the accept function, indicating the presence and activity of the PygmyGoat malware.
This rule detects the Voldemort backdoor by identifying specific byte patterns related to its configuration decryption, general decryption algorithm, access token request mechanism, network communication routines, and data download functions from its command and control (C2) server. The rule looks for a combination of these distinct code segments within a Windows executable (MZ header).
This YARA rule detects the GTPDOOR backdoor by identifying specific byte patterns within its code. The rule includes two main detection blocks, one for 'v1' and another for 'v2' versions of the backdoor, each looking for distinct functions related to sending results to a peer, executing remote commands, sending replies, and checking if the daemon is already running. The 'v1' block specifically targets functions like 'send_result_to_peer_v1_p*', 'execute_remote_command_v1', 'send_reply_v1_p*', and 'daemon_already_running_check_v1'. The 'v2' block targets 'send_result_to_peer_v2_p*', 'execute_remote_command_v2', and 'main_routine_v2_p*'. The rule also ensures the file is an ELF executable by checking the magic bytes at the beginning of the file.
This rule detects the Linodas backdoor on Linux systems by identifying specific byte patterns related to its persistence mechanisms for Ubuntu and RedHat distributions, network communication functions, and machine ID generation routines. The rule looks for a combination of these patterns to ensure high fidelity detection of the malware.
This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
This rule detects the Linux_Backdoor_Krasue malware. It identifies specific byte patterns within the executable that correspond to functions for switching servers, getting hostname information, starting server processes, sending encrypted data, and notifying the server. The rule also checks for the ELF magic number to ensure it's a Linux executable.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
Page 2 of 2