Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
3
Products / Services
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects file access events involving specific file names ('DscCoreR.mui', 'SyncRes.dat', 'GameInputInboxs32.mui', 'diagerr.xml', 'NtfsLog.etl', 'Ignored.Dat', 'VistaCompat.nls') that have been historically observed as indicators of the HUI Loader malware. HUI Loader is a custom DLL loader used by various threat actors to sideload malicious payloads.
This rule detects the creation of a zero-byte file named 'pic1.png' followed by the execution of any process from the same directory within a specified time window. This behavior is indicative of the DiaoYu Loader, which uses a zero-byte 'pic1.png' as a guardrail or check before executing its malicious payload.
Detects the creation of a zero-byte 'pic1.png' file alongside an executable in the same directory, a TTP associated with the Diaoyu Loader's anti-sandbox integrity check. This behavior indicates an attempt to evade detection by verifying the execution environment.
