Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
102 detections
Filters
Last updated
All Time
Detection languages
47
23
13
11
7
Contributors
29
27
12
8
4
Categories
48
33
33
26
14
Platforms
92
13
1
1
Products / Services
34
21
14
12
9
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
7
3
IDS Protocols
8
2
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
This rule detects the execution of a VBScript file named 'ResetRealtekAudioSettings64.vbs' by 'wscript.exe'. This specific activity has been associated with AsyncRAT, where it's used to continue the execution chain, potentially to spoof audio settings or for other malicious purposes.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
This rule detects the execution of PowerShell or batch scripts that mimic legitimate Realtek audio services, a known tactic used by AsyncRAT. Specifically, it looks for process command lines containing "RealtekAudioService64.ps1", "RealtekAudioService64.bat", "RealtekAudioEnhancements64.ahk", or "RtkNGUI64.ahk".
Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects AutoHotkey (AHK) scripts spawning specific .NET Framework processes (cvtres.exe, AddInProcess32.exe, AppLaunch.exe, aspnet_compiler.exe), which is indicative of process hollowing, often used by malware like AsyncRAT to inject malicious code into suspended legitimate processes.
Detects execution of scripts using exact names mapped to the AsyncRAT infection chain. These script names are associated with malicious activity often disguised as legitimate Realtek audio components.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
Detects AutoHotkey scripts injecting into legitimate .NET binaries for defense evasion, specifically targeting processes associated with AsyncRAT. The rule looks for AutoHotkey.exe or command lines containing '.ahk' initiating processes that are known .NET binaries like AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe.
Identifies the use of wscript.exe to execute VBScript files that are disguised as Realtek audio settings, specifically looking for 'ResetRealtekAudioSettings64' in the command line. This pattern is associated with AsyncRAT.
Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.
Detects execution of specific AutoHotkey (AHK) scripts associated with AsyncRAT, where threat actors abuse AHK to reflectively inject .NET remote access trojans.
Detects scheduled tasks named "CheckRealtekAudioVersion" or "RealtekAudioEnhancements64" created for AsyncRAT persistence. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' argument and the presence of these specific task names in the command line, which are known indicators of AsyncRAT establishing persistence.
Detects the creation of various payload and configuration files (VBS, BAT, AHK, PS1, or files containing 'Subtitles') inside the 'Microsoft.WindowsSoundDiagnostics' directory, which is a known technique used by malware like AsyncRAT to evade detection.
Detects modifications to the registry re-enabling Windows Script Host to execute VBS payloads, often associated with malware like AsyncRAT.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
Page 3 of 5