Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
102 detections
Filters
Last updated
All Time
Detection languages
47
23
13
11
7
Contributors
29
27
12
8
4
Categories
48
33
33
26
14
Platforms
92
13
1
1
Products / Services
34
21
14
12
9
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
7
3
IDS Protocols
8
2
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
This rule detects attempts to evade Windows Defender by adding exclusion paths or processes using PowerShell's Add-MpPreference cmdlet. Specifically, it looks for commands that attempt to exclude 'C:\' or 'powershell.exe', a technique known to be leveraged by AsyncRAT.
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
This rule detects the execution of PowerShell or AutoHotkey processes that include 'RtkLoggingManifest.man' in their command line. This behavior is indicative of AsyncRAT attempting to reconstruct a hidden .NET executable payload by parsing integers from a fake manifest file.
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
Detects PowerShell scripts that contain custom bit-reversal and XOR decoding routines used to deobfuscate an embedded byte blob, followed by the reflective loading of that blob into memory as a .NET assembly using [Reflection.Assembly]::Load. This behavior is associated with loaders like cap.ps1 used to deploy RATs such as AsyncRAT.
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Page 2 of 5