Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
56
27
20
4
3
Contributors
31
25
20
4
4
Categories
55
37
23
15
14
Platforms
101
9
2
1
Products / Services
22
22
6
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects Inf0s3c Stealer, a Python-based malware that is typically packed with PyInstaller and then compressed with UPX. This rule identifies files containing artifacts from both packers, along with strings specific to the stealer.
Detects the ConfuserEx-protected .NET loader for DarkCloud Stealer. This loader decrypts and injects the final VB6 payload.
This detection identifies attempts to execute PowerShell commands that have been obfuscated using Base64 encoding. Attackers frequently employ Base64 encoding to conceal malicious scripts, evade signature-based antivirus solutions, and make it more difficult for security analysts to quickly understand their true intent.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects the image load of "Python Core" by a non-Python process. This might be indicative of a Python script bundled with Py2Exe.
This query was originally published in the threat analytics report, CVE-2018-15982 exploit attacks.
CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary code. It has since been patched.
Actors have been observed using this vulnerability in targeted attacks. Exploits for CVE-2018-15982 have also been included in several exploit kits.
In some initial attacks exploiting CVE-2018-15982, attackers sent targets spear-phishing emails. The emails would include an attached RAR archive, which contained a lure document, as well as a second archive disguised as a .jpg file. Opening the document would automatically run an embedded Flash ActiveX control. This, in turn, would call a script containing the exploit. The exploit's ability to run arbitrary code would be employed to unpack and run a payload from the second archive. The payload is a backdoor used both to achieve persistance and for command and control.
The following query detects possible instances of a payload being extracted by the exploit.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-15982
https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
CVE-2018-15982 is an exploit of Adobe Flash Player, that allows for remote execution of arbitrary code. It has since been patched.
Actors have been observed using this vulnerability in targeted attacks. Exploits for CVE-2018-15982 have also been included in several exploit kits.
In some initial attacks exploiting CVE-2018-15982, attackers sent targets spear-phishing emails. The emails would include an attached RAR archive, which contained a lure document, as well as a second archive disguised as a .jpg file. Opening the document would automatically run an embedded Flash ActiveX control. This, in turn, would call a script containing the exploit. The exploit's ability to run arbitrary code would be employed to unpack and run a payload from the second archive. The payload is a backdoor used both to achieve persistance and for command and control.
The following query detects possible instances of a payload being extracted by the exploit.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-15982
https://helpx.adobe.com/security/products/flash-player/apsb18-42.html
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
This rule detects the Domaiq Potentially Unwanted Application (PUA) by identifying a specific payload string and a combination of code patterns. These patterns include checks for NSIS (Nullsoft Scriptable Install System) integrity, UPX (Ultimate Packer for eXecutables) decompression and encryption, various dumping functions, and exception handling routines. The presence of these combined signatures indicates the likely presence of the Domaiq PUA.
Win32 PUA Domaiq
YARA
Yara rule that detects Domaiq potentially unwanted application.
Page 6 of 6