Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
10
10
4
1
1
Contributors
12
4
3
2
2
Categories
13
10
7
6
5
Platforms
25
3
1
Products / Services
10
8
5
4
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
3
1
Identifies regasm.exe executing a payload disguised as a .txt file, a technique observed in CloudZ RAT intrusions to proxy the execution of its .NET loader.
Regasm Executing Text File Payload
Cortex XDR
Identifies regasm.exe executing a payload disguised as a .txt file. This technique is used by the CloudZ RAT dropper to execute its disguised .NET loader via a scheduled task while evading standard executable-based alerting. The rule specifically looks for 'regasm.exe' in the process image name and '.txt' in the command line, with additional specificity for '/nologo', 'update.txt', or 'msupdate.txt' to narrow down to known campaign indicators.
Detects cmd.exe executing a batch script disguised with a .txt extension, a persistence technique used by SERPENTINE#CLOUD. The campaign delivers VenomRAT, AsyncRAT, XWorm/Violet, PureHVNC, and Brute Ratel C4 via ClickFix lures and Cloudflare tunnels.
Detects a file with a .mp5 extension in the /tmp directory being made executable via chmod. This technique was used by a stager to deliver the Rekoobe backdoor by masquerading ELF binaries as media files to evade detection.
The analytic identifies a suspicious process executed from within common container/archive file types such as ZIP, ISO, IMG, and others. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is a common technique used by adversaries to execute scripts or evade defenses. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or persist within the environment, posing a significant security risk.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.
Page 2 of 2