Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
66
33
21
13
10
Contributors
80
18
15
10
8
Categories
57
52
49
48
32
Platforms
149
15
9
7
2
Products / Services
49
49
11
8
7
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
IDS Classtypes
2
IDS Protocols
1
1
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
Yara rule that detects OrcusRAT backdoor.
Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.
Detects PowerShell scripts that contains reference to keystroke capturing functions
Adversaries may log user keystrokes to intercept credentials as the user types them.
Page 9 of 9