Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
29
17
4
2
1
Contributors
13
11
10
5
4
Categories
44
14
10
7
5
Platforms
49
6
2
1
Products / Services
15
12
9
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects HTTP requests that contain 'gcc' and '-o' in the URI, which could indicate an attempt to compile malware on a host using the GCC compiler. This activity is often associated with defense evasion techniques where an attacker compiles malicious code directly on a compromised system.
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Attackers might abuse this in order to bypass application whitelisting.
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects the FileZilla executable (filezilla.exe) spawning the C# compiler (csc.exe). This behavior is highly anomalous for a standard FTP client and is a technique used by a trojanized FileZilla variant to perform runtime .NET compilation for its payload.
This rule detects activities associated with the SSHStalker botnet. It identifies outbound IRC-like network traffic on common IRC ports (6667, 6697, 7000) over TCP. It also looks for persistence mechanisms by monitoring writes to common cron job directories and files on Linux systems. Additionally, the rule detects log tampering attempts by monitoring writes to critical system log files such as /var/run/utmp, /var/log/wtmp, and /var/log/lastlog. Finally, it identifies on-host compilation activities, specifically the execution of compilers (gcc, cc, clang) or build tools (make) within suspicious temporary directories like /tmp, /var/tmp, or /dev/shm, which can indicate malware compilation.
Flags csc.exe invocations compiling from Temp/AppData paths, a practical pivot for GTIG-described malware that compiles C# code obtained at runtime (e.g., via LLM API responses).
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
Detects the compilation of an executable in a temporary directory, followed by its execution and subsequent deletion. This pattern is indicative of an adversary attempting to compile and run tools on a target system while minimizing forensic artifacts.
The analytic detects instances where `vbc.exe`, the Visual Basic Command Line Compiler, initiates DNS queries. Normally, `vbc.exe` operates locally to compile Visual Basic code and does not require internet access or to perform DNS lookups. Therefore, any observed DNS activity originating from `vbc.exe` is highly suspicious and indicative of potential malicious activity. This behavior often suggests that a malicious payload is masquerading as the legitimate `vbc.exe` process to establish command-and-control (C2) communication, resolve domains for data exfiltration, or download additional stages of malware. Security teams should investigate the process's parent, command-line arguments, and the resolved domains for further indicators of compromise.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Attackers might abuse this in order to bypass application whitelisting.
Page 2 of 3