Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
23
11
6
4
3
Contributors
22
11
7
5
3
Categories
26
18
9
7
6
Platforms
48
6
2
Products / Services
22
7
4
4
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects the execution of psql.exe to query the Veeam Backup & Replication PostgreSQL database for stored credentials. This pattern is associated with credential theft techniques utilized during ransomware operations (e.g., Bumblebee, Akira) where sensitive configuration or credential data is retrieved and potentially later decrypted via DPAPI.
This rule detects potential Bumblebee loader activity by identifying files named 'msimg32.dll' that possess specific known builder file versions and exhibit anomalous, dictionary-derived 'gibberish' entries within their PE version information metadata fields (Comments, CompanyName, or FileDescription).
Detects BumbleBee loader binaries that utilize the GetSystemDefaultLocaleName API to perform geofencing, intentionally exiting if the system locale matches specific CIS (Commonwealth of Independent States) region strings. This behavior is used by the malware to avoid infection of systems in these regions.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects the Bumblebee loader by identifying a hardcoded list of CIS-region locale strings within the file, used in conjunction with 'GetSystemDefaultLocaleName' and 'ExitProcess' to perform an anti-analysis kill switch, terminating execution if the infected system is located in a Commonwealth of Independent States (CIS) region.
Loader malware delivering follow-on ransomware payloads
Detects potential SSH reverse tunneling or SOCKS proxying, often used by threat actors like Akira or associated with Bumblebee loaders, to establish persistent C2 channels. The rule monitors process execution of plink.exe and ssh.exe with suspicious arguments (e.g., -R, -D, -N), network connections to known malicious C2 IP addresses, and SSH tunnel processes running as SYSTEM or spawned by non-interactive service-related processes.
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Detects outbound network connections to known BumbleBee loader and AdaptixC2 infrastructure, or DNS lookups for BumbleBee download gateway domains. The rule further filters these network events by inspecting the source process to ensure it matches common LOLBAS (Living Off the Land Binary and Scripting) utilities or execution from temporary user paths, indicating potential malicious payload retrieval.
Detects the Bumblebee loader technique where the Windows UAC consent UI (consent.exe) loads a malicious msimg32.dll from a non-standard, user-controlled path (such as a temporary directory created by a trojanized MSI installer) instead of the legitimate Windows system directory.
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects a suspected malicious activity sequence where PowerShell is used to download the cloudflared utility from GitHub, followed by a silent MSI installation of cloudflared. This sequence is indicative of post-exploitation activity often associated with Bumblebee malware leading to the establishment of covert C2 tunneling, frequently observed in Akira ransomware intrusion chains.
Detects the execution of consent.exe from a specific Bumblebee loader installation path (ApplicationInstallationFolder_11) within the user's temporary directory. This activity is indicative of the Bumblebee loader, which utilizes DLL side-loading of a malicious msimg32.dll and incorporates locale-based checks to evade execution in certain regions.
Page 1 of 3