Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
3
1
1
1
Platforms
3
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
This rule detects the dlMarlboro downloader based on specific byte patterns found within the executable. The patterns '$ping_apnic', '$download_bin_1', and '$download_bin_2' are indicative of the malware's code for network communication (pinging apnic) and downloading additional binaries.