Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
56
27
20
4
3
Contributors
31
25
20
4
4
Categories
55
37
23
15
14
Platforms
101
9
2
1
Products / Services
22
22
6
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects PyInstaller-built UltraVNC installer renamed to svchost.exe and staged for deployment to the non-standard C:\Windows\Fonts\web directory
Detects PureLogs Stealer payload binaries by identifying specific artifacts including a hardcoded nibble-decoding alphabet, minimal PE imports, and high-entropy sections containing obfuscated Windows API strings like GetProcAddress, kernel32.dll, and ntdll.dll.
Detects Amatera Stealer shellcode anti-emulation patching stub using cff_state control-flow flattening and inplace_xor_decrypt reflective loader routine
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects DeviceManager RAT stager delivered as a Delphi-compiled Inno Setup installer requiring the /SL5 IPC relaunch flag together with an appended high-entropy overlay, plus optional is-DWA04JDXUI.tmp / MicroUpdaterV1.exe indicators, to reduce false positives from benign Inno Setup installers that also use /SL5
Detects PE binaries with stripped DOS stub, zeroed checksum, and an additional corroborating structural anomaly (zeroed timestamp or entry point outside declared sections), consistent with CountLoader's PE-header patching technique used for in-memory/reflective execution of patched PE images
Detects CornFlake RAT Go stub/standalone build artifacts: requires the Go-compiled size/entropy heuristic to co-occur with a localized high-entropy PE section consistent with an XOR-encrypted embedded C2 config, and with absence of the standard main.main symbol consistent with garble-style symbol obfuscation, rather than matching on size/entropy alone
Detects cross-process memory operations and CreateRemoteThread calls targeting explorer.exe or svchost.exe from non-standard (untrusted) process paths. This activity is consistent with StealC infostealer unpacking and injection behavior, typically following initial execution by SmartLoader as seen in recent FakeGit/AgentBaiting campaigns.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects PE files exhibiting combined structural anomalies consistent with Dolphin X's opt-in mutation engine tiers: altered PE compile timestamp, rewritten section padding (raw size vastly exceeding virtual size), and per-build re-encrypted embedded strings surfacing as high-entropy sections
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects PE files identified as SourTrade payloads by identifying the presence of a '.bun' section, an embedded 'app.js' string indicative of JavaScriptCore usage, and a high-entropy data block within the '.bun' section, distinguishing malicious payloads from legitimate Bun-compiled binaries.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
day1 CruLoader
YARA
This YARA rule detects the presence of the Cruloader malware by identifying specific embedded strings associated with its operation, such as custom character sets and internal identifiers, as well as unique code sequences characteristic of its cryptographic implementation.
Matches known Umbrij ConfuserEx-obfuscated .NET malicious DLL samples across three tool versions by full-file MD5 hash
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Page 3 of 6