Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
Detects the use of the GNU Debugger (GDB) to dump memory from a live process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets directly from memory, bypassing file-based security controls.
The rule detects the creation of processes that utilize specific mutex names associated with the Rhadamanthys stealer. Specifically, it looks for the mutex name 'Global\MSCTF.Asm.{digits}', where '{digits}' represents a variable sequence of numbers. This mutex pattern is a known indicator of Rhadamanthys stealer activity, suggesting the presence of this malware on the system.
Detects known mutexes associated with Typhon stealer activity. The rule specifically looks for the mutex name 'GOJJL2LPIZM04XC0NQ4I' in process creation events on Windows systems.
Detects known mutexes associated with XLoader stealer activity by looking for specific mutex names created during process creation events on Windows systems.
This rule detects the creation of processes that utilize specific mutex names associated with XenoStealer malware. The detection is based on the presence of the mutex 'aMdFrsHoGcGgAKUyLCoEIuoHpvwCAzaz', which is a known indicator of XenoStealer activity. This activity falls under the 'process_creation' category within Windows environments.
The rule detects the presence of specific mutex names associated with the VipersoftX stealer. It looks for two distinct mutex names: 'acb2f45f62c34c94bbd6e86734eb01a1' and '8cda13f8-a407-4a48-8284-411709e090'. The detection is based on process creation events on Windows systems where these mutex names are observed.
This rule detects the creation of specific mutexes known to be associated with the RedLine stealer malware. The detection is triggered when a process creates a mutex named 'winter750'.
The rule detects the presence of specific mutex names ('kwnmsgyyay') that are known to be associated with the WhiteSnake stealer malware. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the creation of specific mutexes known to be associated with the Stealc stealer malware. The rule specifically looks for mutex names 'GentleSpade' and '5rjtejk5rytrr'. The presence of these mutexes indicates potential Stealc stealer activity on a Windows system.
The rule detects the creation of specific mutexes associated with SpeedStealer malware. It specifically looks for a mutex named 'gamcop'. The detection is based on monitoring process creation events on Windows systems.
This rule detects the creation of specific mutexes that are known to be associated with the Skuld stealer malware. The detection is based on the exact string match of the mutex name 'global\3575651c-bb47-448e-a514-22865732bbc'. The rule leverages process creation logs to identify these mutexes, indicating potential Skuld stealer activity on a Windows system.
The rule detects the creation of specific mutexes known to be associated with the RecordBreaker stealer. It looks for a mutex named 'iqroq5112542785672901323' during process creation events on Windows systems. The presence of this mutex indicates potential RecordBreaker stealer activity.
This rule detects the creation of a process that utilizes a mutex name associated with the Meduza stealer malware. Specifically, it looks for the mutex pattern 'mmm-<uniqueid>'.
The rule detects the creation of specific mutexes known to be associated with the Luxy stealer malware. It specifically looks for the mutex name 'DBPC303NG10hWTOR7NoN'. This activity is indicative of the Luxy stealer running on a system, which typically aims to steal credentials and other sensitive information.
The rule detects the creation of specific mutexes associated with KiwiStealer malware. It looks for the mutex name 'rabadaisunique' in process creation events on Windows systems. This activity is indicative of KiwiStealer attempting to ensure only one instance of itself is running.
This rule detects the creation of a process that utilizes specific mutex names ('patatoes') known to be associated with the Socelars stealer malware. The detection is based on monitoring process creation events and checking for the presence of these mutex names.
The rule detects the creation of specific mutexes known to be associated with the QuietSieve stealer malware. The detection is based on the presence of the mutex name 'Global\lCHBaUZcohRgQcOfdIFaf'. This activity indicates potential QuietSieve stealer infection on a Windows system.
This rule detects the creation of a specific mutex named 'Global\PrysmaxSingleInstanceMutex'. This mutex is known to be associated with the Prysmax stealer malware. The presence of this mutex indicates potential Prysmax stealer activity on the system.
The rule detects known mutexes associated with FFDroider stealer activity. Specifically, it looks for the mutex name '37238328-1324242-5456786-8fdff0-67547552436675' during process creation events on Windows systems.
Page 13 of 17