Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
3
1
Categories
3
2
1
1
1
Platforms
3
2
1
Products / Services
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
Detects Linux VDSO hijacking for privilege escalation without syscalls
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.