Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
56
27
20
4
3
Contributors
31
25
20
4
4
Categories
55
37
23
15
14
Platforms
101
9
2
1
Products / Services
22
22
6
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders. Specifically looks for .pyc files with 20 or more alphanumeric characters in their name, created in a temporary folder path matching the pattern '_MEI[0-9]+'.
Detects use of strip or UPX to remove debug information from malware
This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.
Detects stripped executable payloads with debug information removed for evasion
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.
Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.
Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.
Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.
Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
Detects a specific PowerShell command pattern used by the DeadVax malware campaign. The malware uses a self-parsing technique to read its own batch script file and extract a hidden, encoded payload from lines starting with an '@' character.
Detects the creation of specific file artifacts used by the DeadVax loader as staging containers for encrypted payloads. The malware uses `rEgX.cmd` as a self-copy, `windows.dll` as a temporary text file to hold a Base64 payload, and `boot64x.w` to store the final shellcode.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects execution of specific Python scripts (modes.py, extentions.py, udp.pyw) using the windowless Python interpreter (pythonw.exe) from user-writable locations. This behavior is a strong indicator of ModeloRAT delivered via the CrashFix/ClickFix campaign using portable WinPython for stealth.
This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.
Upx Packer
YARA
Generic detection for UPX packer
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects Remcos RAT payloads and commands
This rule detects when a non-Python process loads the "Python Core" image. This behavior is often indicative of an executable that has been bundled from Python code using tools like Py2Exe, PyInstaller, or cx_Freeze. Threat actors commonly use these tools to package malicious Python scripts into standalone executables, which can help obfuscate their code or bypass security measures. The rule filters out legitimate Python processes and common installation paths to reduce false positives.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Page 5 of 6