Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
102 detections
Filters
Last updated
All Time
Detection languages
47
23
13
11
7
Contributors
29
27
12
8
4
Categories
48
33
33
26
14
Platforms
92
13
1
1
Products / Services
34
21
14
12
9
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
7
3
IDS Protocols
8
2
Identifies the creation of scheduled tasks masquerading as Realtek audio services for persistence, often associated with AsyncRAT.
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Detects the use of 'findstr' and 'more' commands by 'cmd.exe' to parse PDF files, which is often associated with malicious activity, such as that initiated by malicious LNKs delivering AsyncRAT.
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
This rule detects the execution of 'cmd.exe' with a command line that includes 'type', '.pdf', 'more', and 'findstr'. This specific combination of commands is indicative of a technique used by AsyncRAT to extract and execute malicious code hidden within a decoy PDF file by reading specific line ranges.
This rule detects consecutive TLS application data records with 32-byte encrypted payloads. This specific record pattern has been observed during AsyncRAT encrypted communication. The rule is port-independent and serves as a supporting indicator for AsyncRAT activity, rather than a standalone high-confidence signature.
This rule detects attempts by PowerShell to modify the Windows Registry to re-enable Windows Script Host. This behavior has been observed with AsyncRAT, which may attempt to repair the script environment if it was disabled by defenders.
Detects querying of the NLS/Language registry key, which is often used by Remote Access Trojans (RATs) like VenomRAT and AsyncRAT for system profiling and reconnaissance. The rule specifically looks for processes other than common system processes (svchost.exe, explorer.exe) accessing this registry key.
Detects the creation of the AsyncRAT specific mutex 'AsyncMutex_6SI8OkPnk'. This mutex is a unique identifier used by AsyncRAT to ensure only one instance of the malware is running on a system, making its creation a strong indicator of compromise.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python interpreter (python.exe or pythonw.exe), potentially renamed, from a non-standard, user-writable location.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
Detects PowerShell downloading a batch file (.bat) into the user's Startup folder. This is a common persistence technique (T1547.001) and was observed in an AsyncRAT campaign where the payload was downloaded from a malicious `trycloudflare.com` domain.
Detects the execution of a Python script from a non-standard user directory, using command-line parameters consistent with a tool used for Asynchronous Procedure Call (APC) injection. This specific command was observed in an AsyncRAT campaign where a script named 'ne.py' was used to inject a payload ('new.bin') into the explorer.exe process.
Detects commands accessing a remote WebDAV share hosted on a trycloudflare.com domain. This technique has been observed in AsyncRAT campaigns where a malicious Internet Shortcut (.url) file initiates the connection to download and execute further payloads.
Detects the use of PowerShell to download and/or expand a Python environment from the official python.org website. This technique has been observed in AsyncRAT campaigns to stage a legitimate interpreter for executing malicious Python code, bypassing defenses that might block known malicious executables.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
The analytic detects Microsoft OneNote spawning `mshta.exe`, a behavior often associated with spearphishing attacks. This activity is significant as it is commonly used by malware families like TA551, AsyncRat, Redline, and DCRAT to execute malicious scripts. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.
The analytic detects a process enabling the "SeDebugPrivilege" privilege token, leveraging Windows Security Event Logs with EventCode 4703. This privilege allows a process to inspect and modify the memory of other processes, which can lead to credential dumping or code injection. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, an attacker could gain extensive control over system processes, enabling privilege escalation, persistence, or access to sensitive information.
Page 4 of 5