Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
20
11
3
2
2
Contributors
20
3
2
2
2
Categories
32
9
5
4
4
Platforms
35
6
1
Products / Services
10
9
5
4
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects Blind Eagle JC-46 toolkit static artifacts: leftover XLoader/FormBook builder tag and variable name in decrypted PowerShell orchestrator stages, leaked CryptoObfuscator PDB path in the Paralell.dll injector, forged NVIDIA version-resource string, and Spanish-language HVNC/browser-clone distraction overlay text in the AsyncRAT payload
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Page 1 of 2