Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
3
1
1
Platforms
4
Products / Services
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the execution of common process and memory analysis tools. The presence of these tools on a standard user endpoint could indicate reconnaissance, reverse engineering, or an attempt by malware to check for an analysis environment. This list is based on tools blacklisted by the Stealit malware.