Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
21
20
9
2
2
Contributors
24
7
5
4
3
Categories
28
19
15
9
5
Platforms
51
3
2
1
1
Products / Services
25
15
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
Detects the execution of DcRAT malware by monitoring for the creation of the specific global mutex 'Global\ShitSetupOn26126k' commonly used by this strain to enforce single-instance execution on a host.
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Loader used in click-hijacking traffic distribution scheme
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Credential and browser data stealer distributed via OXLOADER campaigns
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
Detects the creation of a mutex with a specific pattern used by the MonsterV2 malware, a sophisticated RAT, loader, and stealer.
Detects the unique hardcoded mutex created by the Dropping Elephant in-memory RAT to prevent duplicate infections. This rule specifically looks for the mutex string 'kshdkfhskdfjkhsdkfhsjkdfhkj' during global object or mutex creation events.
Detects the creation of the XWorm specific mutex 'HOHE6S8FaZZlGf0f'. This mutex is known to be used by the XWorm malware to ensure only a single instance of itself is running on a system.
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
Detects malware using mutexes to prevent multiple instances running simultaneously
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
Page 2 of 3