Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
850 detections
Filters
Last updated
All Time
Detection languages
446
161
65
46
46
Contributors
175
159
104
84
49
Categories
477
314
189
117
116
Platforms
734
96
51
26
25
Products / Services
300
169
66
66
54
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
850
CVEs
4
4
2
2
2
IDS Classtypes
31
27
6
2
IDS Protocols
28
13
13
9
1
This rule detects the creation of specific mutexes known to be associated with the Xtreme RAT (Remote Access Trojan) malware. The detection is triggered when a process creates a mutex named 'XTREMEUPDATE'. The presence of these mutexes indicates potential Xtreme RAT activity on a Windows system.
The rule detects the creation of specific mutex names associated with RevengeRAT malware. It looks for mutexes named 'RV_MUTEX-<random>', which are known indicators of RevengeRAT activity. This detection focuses on the process creation logs within Windows environments to identify these mutexes.
The rule detects the creation of a process that utilizes specific mutex names associated with XieBroRAT malware. Specifically, it looks for the mutex name 'pLONGFEIFFmm1'. This indicates potential XieBroRAT activity on a Windows system, likely related to its command and control or persistence mechanisms. The detection is based on process creation events where these mutex names are observed.
This rule detects the creation of specific mutexes associated with the Xeno RAT malware. It looks for mutex names starting with 'xeno_rat_nd' followed by five alphanumeric characters, optionally ending with '-admin'. The detection is based on the `MutexName` field within process creation logs.
This rule detects the creation of specific mutexes known to be associated with SpiceRAT malware activity. The detection is based on two distinct mutex names: '{00866F68-6C46-4ABD-A8D6-2246FE482F99}' and '{00861111-3333-4ABD-GGGG-2246FE482F99}'. The rule monitors process creation events on Windows systems for the presence of these mutex names.
This rule detects the creation of specific mutex names known to be associated with the DarkComet Remote Access Trojan (RAT). The mutex names include patterns like 'DC_MUTEX-<7 Alphanumeric Characters>', 'DCMIN_MUTEX-<7 Alphanumeric Characters>', and exact strings 'DCMUTEX' and 'DCPERSFWBP'. The detection is based on process creation events where these mutex names are observed.
This rule detects the creation of specific mutexes known to be associated with the BlotchyQuasar Remote Access Trojan (RAT). The rule specifically looks for the mutex name '44474877AKs8XXT4SylAo2kAlUS2kYkala!'. Detection of this mutex indicates potential BlotchyQuasar RAT activity on a Windows system.
Detects the creation of specific mutexes known to be associated with AsyncRAT malware. The rule looks for mutex names matching 'AsyncMutex_<uniqueid>', which are characteristic of AsyncRAT activity. This detection helps identify potential AsyncRAT infections on Windows systems by monitoring process creation events for these unique mutex patterns.
The rule detects the creation of processes that utilize specific mutex names associated with the SilverFox RAT. Specifically, it looks for the mutex name 'Global\IsUserAnAdmin'. This indicates potential SilverFox RAT activity on a Windows system.
This rule detects the creation of specific mutexes ('setox-7yssdee') known to be associated with Santarat malware activity. The presence of these mutexes indicates a high probability of Santarat infection on a Windows system.
The rule detects the creation of specific mutexes associated with the RevClient Remote Access Trojan (RAT). It specifically looks for a mutex named 'ZhengReversePC'. The presence of this mutex indicates potential RevClient RAT activity on a Windows system.
This rule detects the creation of specific mutexes known to be associated with PureRAT malware activity. The detection is based on the presence of the mutex name '6ad742cc0dd3'. The rule leverages process creation logs to identify these mutexes, indicating potential PureRAT command and control or other malicious operations.
The rule detects the creation of specific mutexes known to be associated with the Protego Remote Access Trojan (RAT). It specifically looks for a mutex named 'kiuwqyergljkwef'. This activity is indicative of Protego RAT execution or presence on a system.
This rule detects the creation of processes that utilize specific mutex names associated with Persian RAT activity. The detection is based on the presence of the string 'Persian' within the MutexName field during process creation events on Windows systems. This indicates potential command and control (C2) communication or other malicious operations by the Persian RAT.
The rule detects the creation of a process that utilizes a mutex named 'PEGASUS'. This specific mutex name is associated with PegasusRAT, a type of Remote Access Trojan (RAT). The detection logic is based on the presence of this mutex name, indicating potential PegasusRAT activity on a Windows system.
This rule detects the creation of specific mutexes known to be associated with the NodeSnake Remote Access Trojan (RAT). The detection is triggered when a process creates a mutex named 'Global\NodeSnakeMutex'. This activity is indicative of NodeSnake RAT execution or presence on a system.
The rule detects the creation of specific mutex names associated with the Jason RAT malware. It looks for mutexes named 'jason_<uniqueid>'.
This rule detects Python processes that are executed with command-line arguments indicative of silent execution or output redirection to null devices, combined with execution from a temporary directory. This pattern was observed in the dYdX PyPI package compromise, where a RAT ran undetected using these techniques.
This rule detects the creation of specific mutexes known to be associated with 3LOSH RAT activity. Specifically, it looks for the mutex named 'AsyncMutex_Devil'.
The rule detects the creation of specific mutexes associated with the Rimawi RAT. It specifically looks for mutexes named 'AZSXDCFVGBHNqwertyui'. The detection is based on process creation events on Windows systems.
The rule detects the creation of specific mutex names associated with Netdooka RAT activity. The mutex name '3f0d73e2-4b8e-4539-90fd-812330bb39c8' is used as an indicator for this malware. This detection focuses on process creation events on Windows systems.
Page 25 of 41