Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
33
9
8
4
2
Contributors
9
7
7
6
6
Categories
30
13
9
9
7
Platforms
46
5
4
Products / Services
24
7
5
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
This rule detects suspicious process injection activity where an untrusted process attempts to inject code into common trusted Windows processes (svchost.exe, explorer.exe, notepad.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe) using a combination of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls. This behavior is often associated with malware, such as StealC, attempting to evade detection and maintain persistence.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
Detects Vidar Stealer attempting to access virtual memory of Chrome, Edge, or Brave processes to locate the v20_master_key, which is used to bypass Application-Bound Encryption. This rule also identifies suspicious browser process creations with specific command-line arguments that might indicate stealer activity.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects a Python process spawning pip to install multiple libraries (requests, pycryptodome, psutil, pywin32) in a short time frame, a behavior associated with the Arkanix Stealer's Python loader.
Detects user or script launching regedit.exe with command lines targeting the specific 'Edgre' run key, which is associated with persistence mechanisms used by the XenoRAT malware.
Detects when a non-Discord process creates or modifies both 'index.js' and 'package.json' within a Discord desktop core module directory. This file pair is critical for Electron module loading and is often targeted by malware like VVS Stealer to establish persistent session interception.
Detects a process creating both the PyArmor runtime module and Python 3.11 runtime library in user-writable locations. The component pairing is consistent with execution staging for the PyInstaller-packaged, PyArmor-protected VVS sample.
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
Page 1 of 3