Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
19
18
4
3
3
Contributors
10
6
5
4
4
Categories
25
22
15
12
11
Platforms
51
2
Products / Services
18
11
11
6
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects potentially malicious activity involving LNK files being modified, created, or renamed in common locations (Desktop, Quick Launch, Start Menu) correlated with the creation of files ending in '.backup' within 30 minutes. It also independently detects the presence or execution of 'VLCAssistant.exe', which may indicate unauthorized launcher activity or masquerading.
Detects instances where Windows Explorer spawns cmd.exe to execute specific batch files (doxc.bat or config.bat), a behavior often associated with Transparent Tribe (APT36) activity involving malicious LNK shortcuts.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
Detects the creation of an LNK file in the Windows Startup directory, a common technique used to achieve persistence by executing a specific program or script upon user logon.
Detects execution of PowerShell spawned by suspicious processes (e.g., installers or Windows Explorer) involving LNK file patterns or suspicious command-line obfuscation techniques commonly associated with Kimsuky (APT-C-55) activity.
Detects the creation of a specifically named shortcut (.lnk) file in the Windows Startup directory, a common persistence mechanism used by StealC/ClickFix malware variants.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects the execution of VBS scripts (wscript.exe or cscript.exe) that interact with the Windows Startup folder to create shortcuts. This behavior is associated with persistence mechanisms where malicious scripts create masqueraded shortcuts (e.g., SecurityHealth, OneDriveUpdate) in the user's Startup folder, often using hidden attributes to evade detection.
This rule detects when PowerShell is used to create or modify a LNK file within the Windows Startup folder. Adversaries often place malicious LNK files in this directory to achieve persistence, ensuring their code executes upon user login.
This rule detects PowerShell commands that programmatically create a Windows shortcut (.lnk file) targeting a startup folder or mimicking Windows update processes. This behavior is indicative of an adversary attempting to establish persistence by creating a shortcut that executes a malicious script or binary upon user login or system startup, often associated with the QUICSILVER campaign.
Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.
Detects correlated activity where a browser shortcut (.lnk) file is modified/renamed and, within a 15-minute window on the same host, conhost.exe is spawned with --headless and a cmd.exe/cmd "/c start" command line, indicative of shortcut hijacking used to covertly relaunch a payload such as CountLoader.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Page 1 of 3