Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects the full RunPE process-hollowing sequence (suspended process creation, WriteProcessMemory, SetThreadContext, ResumeThread) executed within 30 seconds against an unsigned, non-OS target process.
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Correlates Abyssos file-collection/archival commands (GRABBER_START/FM_GET/FM_ARCHIVE/FM_ADDTOARCHIVE) — requiring at least 5 collected files before an archive — with a subsequent non-standard-port outbound connection within 30 minutes, consistent with staged exfiltration over the AES-GCM C2 channel.
Detects mshta.exe invoked with a remote HTTP(S) URL argument, consistent with CountLoader's taskType 10 command proxying malicious script execution through mshta.exe, excluding local file/HTA paths.
Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.
Detects G12clean.exe creating a kernel driver file (drv.sys or anticheatG13.sys) while its own command line references the XOR key 0xAB, consistent with decoding and dropping an obfuscated driver payload.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects fileless PowerShell execution using an encoded command line consistent with CountLoader v4.5p, corroborated by hidden-window/execution-bypass flags and excluding known legitimate deployment-tool parent processes.
Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.
Detects folder-existence checks for Ledger Live/Wallet, cryptocurrency wallet directories (atomic, Exodus, Guarda, KeepKey, BitBox02), and Signal Desktop under %APPDATA%, correlated with a WMI AV-discovery query from the same process within 15 minutes, consistent with CountLoader's crypto-wallet reconnaissance.
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Detects the DOUBLECUP ClickFix Stage 1 execution chain where a cmd /c for/f loop searches for powershell.exe via the wildcard pattern 'where pow?r?hell.exe' and pipes through findstr "ZZ1984" to locate and extract the steganographic PNG payload marker before invoking PowerShell.
Detects a WMI query against root\SecurityCenter2 AntiVirusProduct for displayName, correlated with an encoded PowerShell execution (-enc/-EncodedCommand/-e) from the same process chain within 10 minutes, consistent with CountLoader's AV-discovery step.
Correlates an outbound public-IP lookup (api.ipify.org/ifconfig.me) with a subsequent PBKDF2/SHA-256/XOR-referencing decode operation within 30 seconds on the same process, consistent with DOUBLECUP's environmental-keying anti-sandbox technique.
Detects PowerShell command lines using CountLoader's distinctive custom regex-based JSON-parsing pattern to strip brackets and build hashtables, avoiding the natively-monitored ConvertFrom-Json cmdlet.
Detects a process deleting the exact file it was launched from within 10 seconds of starting, combined with at least one additional suspicious indicator (unusual parent process, encoded command line, or temp/user-writable path), consistent with CountLoader's self-deletion behavior.
Detects CountLoader copying conhost.exe, powershell.exe, and mshta.exe into user-writable directories with p/c/m OneDrive-style name prefixes and patched PE metadata (OriginalFileName), running outside standard system directories.
Detects CountLoader creating a scheduled task named GoogleUpdateService<GUID> via the Schedule.Service COM object to run an embedded Python environment (App.py) every 25 minutes, masquerading as a legitimate Google Update task.
Detects cross-process memory copy activity via IOCTL code 0x2220C8 or the MmCopyVirtualMemory kernel routine, associated with the Phantom Mantis G13 EDR-killer driver.
Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.
Detects a wmic process query followed by Windows Mutex creation, both initiated by python.exe/pythonw.exe running from a non-standard installation path, within a 5-minute window, consistent with DeviceManager's single-instance enforcement check.
Page 7 of 9