Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the creation of specific persistence artifacts (a VBScript file and a startup shortcut) associated with the ModeloRAT payload delivered by recent ClickFix campaigns. Specifically, it looks for a VBScript file at '\WPy64-31401\python\script.vbs' or a shortcut file named 'MonitoringService.lnk' in a user's startup folder.
Detects XWorm V6 adding update.vbs to the Run registry key in APPDATA or TEMP directories
This rule detects suspicious commands being set in the RunMRU registry key by explorer.exe. It specifically looks for the presence of LOLBins such as powershell, mshta, and curl, as well as obfuscation techniques like caret (^) and ProxyCommand, or patterns indicative of encoded/script execution (e.g., Invoke-Expression, FromBase64String, -eC). This activity is associated with the 'ClickFix' social engineering technique.
Detects scheduled task creation where the task action executes files from Windows Startup folders. This layered persistence combines scheduled tasks (flexible triggers, potential privilege escalation) with startup folder execution for redundancy and resilience.
This rule detects patterns associated with the Yellow Cockatoo RAT, specifically looking for process creation events where an interpreter is executed with command-line arguments containing both XOR encoding indicators and references to shortcut files ('.lnk') for potential persistence or execution.
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
Detects the creation of 'hvnc.py' in the Windows Startup folder, a persistence technique used by the Arkanix Stealer's HVNC module.
This YARA rule set detects various artifacts associated with the Remcos RAT 'ClickFix' campaign. The rules identify persistence mechanisms (registry run keys or scripts involving 'Shotcut video editor', '2120206', and 'shotcut.exe' for DLL sideloading), archive or path indicators ('2120206' and 'shotcut.exe'), clipboard scripts used for dropping malware related to the Shotcut DLL sideloading technique.
Detects file creation in Windows Startup folders which is a common persistence mechanism used by malware. Focuses on executable file types (.exe, .scr, .bat, .cmd, .vbs, .lnk)
Detects Remcos RAT persistence via HKCU Run key "Shotcut video editor" pointing to shotcut.exe under AppData\Local\2120206 (DLL sideloading). All five strings required to avoid false positives.
This KQL query identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
This rule detects the creation of script files (batch, VBS, JS, PowerShell, or shortcut files) within Windows Startup folders. It monitors both user-specific and all-users startup locations. The primary purpose is to identify persistence mechanisms where an attacker or malicious software places a script to execute automatically when the system or user logs on.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This rule detects potential COM hijacking activity associated with APT28's Phantom Net Voxel operation. Specifically, it looks for command-line executions that involve the CLSID_Printers identifier ('2227A280-3AEA-1069-A2DE-08002B30309D') or the 'prnfldr.dll' file, particularly when 'regsvr32' is used. The detection is contextualized by checking if the process originates from common Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or script hosts (wscript.exe, cscript.exe), indicating a potential initial access vector or execution from a malicious macro.
Detects persistence mechanisms used by the OtterCookie malware, part of the Lazarus "Contagious Interview" campaign. It specifically looks for the creation of a 'NodeHelper' registry run key and a 'NodeUpdate' scheduled task.
Traditional Endpoint Detection and Response (EDR) tools primarily monitor live registry APIs (like RegSetValue). Since the attacker modifies the hive file offline and the OS loads it automatically during the logon process, no suspicious registry API calls are ever triggered. This makes the persistence virtually invisible to standard behavioral monitoring until the malicious payload actually executes at logon.
The rule detects the execution and persistence mechanisms of the HoneyMyte CoolClient backdoor. It identifies specific command-line arguments used during execution (' install', ' work', ' passuac') when launched by particular parent processes (Sang.exe or Jarte.exe). It also looks for the creation of 'write.exe' as a child process originating from common data directories (ProgramData, AppData, Temp). Additionally, the rule identifies persistence mechanisms by searching for command lines related to 'media_updaten' (likely a service) or 'ComboxResetTask' (likely a scheduled task).
Detects the creation of a file named '___unique_id___' in a temporary directory. This file is a specific host artifact created by the PeckBirdy framework to store a persistent victim identifier for tracking purposes.
Page 46 of 59