Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
56
27
20
4
3
Contributors
31
25
20
4
4
Categories
55
37
23
15
14
Platforms
101
9
2
1
Products / Services
22
22
6
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.
Detects the BQTLock ransomware distribution chain, where a PyInstaller-packaged loader executable (start.exe) is used to unpack and spawn the primary BQT.exe ransomware payload. The detection monitors for process creation events where start.exe exhibits typical PyInstaller command-line artifacts (e.g., _MEIPASS) and initiates BQT.exe, which is associated with malicious activities including UAC bypass and file encryption.
Detects PE files exhibiting behavior consistent with LokiBot malware, specifically the use of a custom CRC32-variant hash function with a XOR polynomial of 0x4358AD54 for runtime API resolution. This technique is used to evade static import analysis by resolving Windows APIs dynamically via hashed identifiers.
Detects execution patterns associated with the BQTLock ransomware, specifically the PyInstaller-packaged 'start.exe' binary acting as a loader to spawn 'BQT.exe' or other child processes, identified by specific PyInstaller environment artifacts in the command line.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects anomalous thread context manipulation events, specifically those involving multiple SetThreadContext API calls within a short period, consistent with Gargoyle-style ROP/NtContinue sleep obfuscation techniques. This method cycles memory protections during C2 beacon sleep intervals to evade point-in-time memory scanners by keeping executable memory hidden.
Detects memory protection modification patterns indicative of the Ekko sleep obfuscation technique. Ekko cyclically transitions memory regions containing beacon code between PAGE_EXECUTE_READ and PAGE_READWRITE states using timer queue callbacks to evade memory scanning tools. The detection identifies rapid, repeating, bidirectional memory protection changes on private memory regions within a 600ms window.
This rule detects the presence of known LokiBot packed binaries by matching the SHA256 hashes of staged memory section bins that were recovered during unpacking analysis. This indicates a high-confidence match for known malicious samples associated with the LokiBot information stealer.
Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
Detects the execution of a PyInstaller-compiled payload associated with the Yuta/Glove Stealer campaign. The rule monitors for processes launching from temporary _MEI* extraction directories within %APPDATA% or %TEMP%, and specifically identifies the winupdate.exe payload within .cache subdirectories.
Detects HTTP responses containing JavaScript files larger than 1 MB, which is a signature behavior of the Bluekit PhaaS platform. This technique involves serving periodically rotated, obfuscated JavaScript bundles to evade static hash-based detection mechanisms.
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects Node.js processes ('node' or 'node.exe') spawning other processes or executing commands that reference suspicious file paths, such as '.libcache.so' or '.sh.local', or utilizing risky syscall patterns like 'memfd_create' or 'fexecve'. This pattern is often associated with malicious npm post-install scripts or supply chain attacks.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
EchoCreep Decodes AES-CBC Base64 Command
Cortex XDR
Detects a non-browser process combining base64 decoding with AES-CBC processing before launching shell commands. This behavior is indicative of the EchoCreep malware, which uses sophisticated obfuscation techniques to hide its command and control communications.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects PowerShell scripts that reconstruct native cmdlets (e.g., Test-Path) from fragmented character arrays mapped to Simplified Chinese variables, a technique observed in AsyncRAT campaigns for obfuscation.
Page 4 of 6