Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
130 detections
Filters
Last updated
All Time
Detection languages
51
35
18
8
6
Contributors
44
25
8
8
8
Categories
88
38
29
23
17
Platforms
70
47
7
2
2
Products / Services
30
21
20
15
13
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
2
IDS Protocols
2
Detects activity mentioned in Operation Wocao report
Detects activity mentioned in Operation Wocao report
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
The analytic detects the execution of a kworker process with a command line in writable directories such as /home/, /var/log, and /tmp on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process paths. This activity is significant as kworker processes are typically kernel threads, and their presence in writable directories is unusual and indicative of potential malware, such as CyclopsBlink. If confirmed malicious, this could allow attackers to blend malicious processes with legitimate ones, leading to persistent access and further system compromise.
Page 7 of 7