Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects potential process argument spoofing attempts by looking for specific strings within HTTP traffic. It specifically searches for 'CreateProcessW' and 'lpCommandLine' in the file data of HTTP responses, indicating that a client might be receiving a payload designed to create a process with spoofed command-line arguments. This technique is often used by malware to hide its true intentions or evade detection.
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
This query helps in reviewing top policies for user overrides (Allow/Block)
