Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
102 detections
Filters
Last updated
All Time
Detection languages
47
23
13
11
7
Contributors
29
27
12
8
4
Categories
48
33
33
26
14
Platforms
92
13
1
1
Products / Services
34
21
14
12
9
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
7
3
IDS Protocols
8
2
Detects a suspected ClickFix-style delivery mechanism where a user visits suspicious domains mimicking legitimate CLI tools (e.g., Gemini, Claude) via web browsers. The detection correlates this initial network access with subsequent suspicious Windows RunMRU activity and the spawning of shell processes (powershell.exe, cmd.exe) from explorer.exe using encoded or download-oriented command line arguments within a 5-minute window.
Detects outbound TCP traffic originating from internal network hosts to a known hardcoded AsyncRAT C2 IP address (158.51.122.136). This indicates a successful infection where a host has established communication with the C2 infrastructure.
Detects incoming TLS traffic from an external network where the TLS server certificate's Subject Common Name (CN) field matches 'AsyncRAT Server'. This pattern is a known indicator of a beaconing session initiated by AsyncRAT remote access trojan servers.
Detects specific file artifacts associated with an AsyncRAT infection chain that leverages a renamed AutoIT interpreter. The rule looks for the presence of a renamed executable, an encrypted .ini loader script, and an unnamed binary payload staged within a temporary directory, as well as associated batch script activity.
Detects a suspicious process chain where an AutoIT loader (originating from temporary directories or associated with charmap.exe command line anomalies) executes charmap.exe, followed by the loading of amsi.dll within that charmap.exe process. This behavior is indicative of AsyncRAT injection patterns, specifically where charmap.exe is used as a host process to tamper with AMSI via in-memory patching of AmsiScanBuffer.
Detects outbound network traffic and subsequent inbound responses associated with AsyncRAT command and control (C2) communication. This rule monitors connections directed toward a specific hardcoded IP address known to be associated with AsyncRAT activity.
This rule detects the execution of a suspicious, specifically named executable (ogftogcyiblzjccmcbnw.exe) originating from a temporary folder, or the creation/access of a related configuration file (kojuyn.ini) within the same temp directory. This pattern is consistent with the delivery and execution of malicious tools like AsyncRAT or similar threats that often use obfuscated filenames and localized configuration files within temporary user paths.
Detects execution of a specific suspicious executable file masquerading in the Windows Temp directory, coupled with the access of an associated .ini configuration file. This behavior is indicative of AsyncRAT deployment, often involving initial execution or staging of configuration files within volatile user directories.
This rule detects the execution of a specific batch file named 'Right-click to open Invoice Details.bat', or execution of a batch file matching a known malicious SHA256 hash associated with AsyncRAT distribution campaigns.
Detects the execution of AutoIt-related processes from temporary directories that are attempting to load or execute suspicious .ini configuration files or specifically named executables, which is a common delivery mechanism for malware such as AsyncRAT.
This rule detects potential persistence mechanisms where a suspicious batch file (.bat) is placed within the Windows Startup folder and subsequently executed using command-line arguments that include specific file extensions like .exe and .ini. This behavior is indicative of malware, such as remote access trojans (RATs), attempting to maintain persistence upon system reboot.
Detects established outbound TCP connections to a known AsyncRAT C2 IP address on port 4944. This rule identifies infected internal hosts communicating with a malicious server typically used for remote access and control.
Detects high-frequency file creation, opening, or modification events within the Windows AppData Local Temp directory. This behavior, often involving specific obfuscated file names or known malicious process names, is a common indicator of malware payload staging or execution patterns, such as those observed in AsyncRAT infections.
This rule detects the process 'charmap.exe' establishing an outbound network connection to a known AsyncRAT command-and-control (C2) IP address and port. This behavior is indicative of process injection where the legitimate Windows Character Map utility is utilized as a host process for malicious AsyncRAT payload execution.
Detects execution of a specific suspicious executable file masquerading in the Windows Temp directory, coupled with the access of an associated .ini configuration file. This behavior is indicative of AsyncRAT deployment, often involving initial execution or staging of configuration files within volatile user directories.
This rule detects potential persistence mechanisms where a suspicious batch file (.bat) is placed within the Windows Startup folder and subsequently executed using command-line arguments that include specific file extensions like .exe and .ini. This behavior is indicative of malware, such as remote access trojans (RATs), attempting to maintain persistence upon system reboot.
Detects the presence of AsyncRAT's screen-capture functionality, specifically the use of .NET Graphics.CopyFromScreen and MemoryStream routines, identified via Microsoft Antimalware Scan Interface (AMSI) inspection logs within a host process.
Detects the reflective or in-memory loading of the AsyncRAT DLL (Veukuzmw.dll) into the memory space of the legitimate Windows process charmap.exe, characterized by a lack of corresponding disk activity or suspicious process command-line arguments.
Detects Blind Eagle JC-46 toolkit static artifacts: leftover XLoader/FormBook builder tag and variable name in decrypted PowerShell orchestrator stages, leaked CryptoObfuscator PDB path in the Paralell.dll injector, forged NVIDIA version-resource string, and Spanish-language HVNC/browser-clone distraction overlay text in the AsyncRAT payload
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
Page 1 of 5