Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
20
12
7
3
3
Contributors
13
9
4
4
4
Categories
17
14
11
8
6
Platforms
38
8
5
5
1
Products / Services
15
8
5
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects JavaScript keyloggers capturing form field input on web pages
Detects potential keystroke logging activity using Python scripts. It monitors for Python processes invoking keylogging libraries or APIs, modification of power settings to prevent system sleep (a common tactic to maintain logger persistence), and the creation of text or log files in common user-writable directories.
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.
Detects processes associated with Remcos RAT or processes with names matching a GST.*.com pattern that are attempting to capture user input by looking for specific API calls or keywords related to keylogging in the process command line. This could indicate an attempt to steal credentials or other sensitive information.
Detects the creation or writing of BMP files in temporary directories by processes other than common screenshot or image editing tools. This activity can be indicative of malware attempting to capture screenshots or other visual data, potentially for exfiltration or analysis.
Detects network activity associated with Bluekit phishing infrastructure, which utilizes WebSocket connections for real-time browser session exfiltration. The rule monitors for characteristic HTTP upgrade requests to WebSockets containing 'rrweb' or 'session' query parameters, or connections to known Bluekit phishing domains, which allow attackers to stream DOM, keystrokes, and mouse movements from a victim's browser to an attacker-controlled dashboard.
Detects processes associated with Remcos RAT attempting to perform activity logging or idle time monitoring by looking for specific command-line arguments related to window and idle state functions, combined with process names or command lines containing 'Remcos'.
Detects process activity indicative of keylogging by the Remcos RAT loader. The rule specifically looks for processes with 'Remcos' or 'GST*.com' in their file name that also contain command-line arguments related to capturing window text or foreground window information, which are common keylogger behaviors.
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.
Detects processes associated with Remcos RAT attempting to perform activity logging or idle time monitoring by looking for specific command-line arguments related to window and idle state functions, combined with process names or command lines containing 'Remcos'.
Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Detects fake Windows authentication prompts used to capture credentials
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the string 'keys' (case-insensitive) and the data size is greater than 200 bytes. This combination suggests that a keylogger might be sending captured keystrokes or other sensitive data to a remote server.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.
Detects XenoRAT command and control information stealer file access activity. XenoRAT reads browser profile data, including logins.json, Web Data, Cookies, Local Extension Settings, chromium_plugins, and profiles.ini, as well as cryptocurrency wallet files such as _key.txt, _v20.txt, and directories under Wallets. The detection triggers when a process executing from a writable or temporary path, or matching known XenoRAT hashes including MalwareBazaar samples and the UPX packed variant bb7f5743, accesses these paths under AppData or ProgramData. For higher confidence, correlate with xenorat_execution on the same host.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
Page 2 of 3