Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
77
60
14
13
13
Contributors
72
29
26
19
18
Categories
58
58
39
35
28
Platforms
191
12
10
6
5
Products / Services
69
53
12
12
7
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
3
1
1
IDS Protocols
5
Detects the BotHelper RAT performing live screen surveillance by identifying repeated high-frequency JPEG frame uploads to the '/api/v1/screen_live.php' endpoint, initiated by the 'msedge_proxy.exe' process.
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Detects anomalous network traffic patterns from 'rnpkeys.exe', a known loader associated with the Sauron malware, communicating with predefined command-and-control (C2) domains or over HTTPS. The rule identifies high volumes of short-lived, frequent connections indicative of fragmented exfiltration (e.g., screenshots) blended into regular beaconing activity.
Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.
Detects the ReportDump.exe process initiating a network connection on port 15847 followed by the loading of GDI/User32 libraries shortly thereafter. This behavior is indicative of SectopRAT establishing a command-and-control channel and initializing screen capture capabilities.
Detects a specific behavioral chain associated with the CHOSEN BRICK implant. This rule identifies when a suspected malicious process writes image/screenshot files (.png, .jpg, .bmp) to disk, followed by a network connection to the Telegram Bot API within a 15-minute window, suggesting potential data exfiltration.
Detects PowerShell execution that combines screen capturing capabilities (System.Drawing.Bitmap, Windows.Forms) with network communication (System.Net.WebClient) directed towards known C2 domains (medianewsonline.com) using specific exfiltration parameters (OKey, Who).
Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.
Detects a specific behavioral chain associated with the CHOSEN BRICK implant. This rule identifies when a suspected malicious process writes image/screenshot files (.png, .jpg, .bmp) to disk, followed by a network connection to the Telegram Bot API within a 15-minute window, suggesting potential data exfiltration.
Detects anomalous network traffic patterns from 'rnpkeys.exe', a known loader associated with the Sauron malware, communicating with predefined command-and-control (C2) domains or over HTTPS. The rule identifies high volumes of short-lived, frequent connections indicative of fragmented exfiltration (e.g., screenshots) blended into regular beaconing activity.
Detects anomalous network traffic patterns from 'rnpkeys.exe', a known loader associated with the Sauron malware, communicating with predefined command-and-control (C2) domains or over HTTPS. The rule identifies high volumes of short-lived, frequent connections indicative of fragmented exfiltration (e.g., screenshots) blended into regular beaconing activity.
Detects anomalous network traffic patterns from 'rnpkeys.exe', a known loader associated with the Sauron malware, communicating with predefined command-and-control (C2) domains or over HTTPS. The rule identifies high volumes of short-lived, frequent connections indicative of fragmented exfiltration (e.g., screenshots) blended into regular beaconing activity.
This rule detects potential screen capture activity performed by either a suspicious executable (SearchTrustedRuntimeSvc.exe) that mimics a screen capture tool or a PowerShell script invoked by Node.js using .NET drawing libraries. This behavior is indicative of unauthorized information gathering, common in remote access trojans (RATs).
Detects the creation of image files (.bmp, .png, .jpg, .jpeg) by processes executing from non-standard directories such as AppData or ProgramData. This behavior is indicative of unauthorized screen capture activities often used by malware for pattern-of-life monitoring, where screenshots are staged in temporary locations before exfiltration. The rule filters out common legitimate applications known to perform screen captures.
Detects processes repeatedly loading GDI/display libraries (gdi32.dll, gdi32full.dll, user32.dll) at a sustained cadence indicative of automated screen capturing. The rule excludes common collaboration and remote access tools known to perform these functions legitimately, flagging high-frequency, long-duration activity consistent with malicious screen scraping techniques.
This rule identifies instances of screen capture events initiated by processes that have previously engaged in network communication with known Remote Management Tool (RMM) domains. By correlating network activity with suspicious endpoint events, it flags potential unauthorized screen scraping performed by tools often abused by attackers for post-compromise reconnaissance.
Detects instances of the Windows Character Map utility (charmap.exe) loading graphics-related libraries such as System.Drawing.dll or gdiplus.dll. These modules are typically not required by charmap.exe and their loading is a common indicator of process injection for the purpose of capturing the screen or desktop interface.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
Detects network requests related to the RatHat Android malware, specifically focusing on the retrieval of the 'minicap' tool used for screen capture and the subsequent exfiltration of captured screen data or video chunks.
Detects the execution of the Android system utility 'getevent' by suspicious processes or in contexts suggesting unauthorized input event monitoring. This may indicate an attempt to capture user input, touch events, or screen interaction data.
Page 1 of 11