Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,386 copies51 likes26,182 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
Detects instances where a process named MsCache.exe deletes files within the Google Chrome User Data directory. This pattern may indicate unauthorized activity by a process masquerading as a cache-related utility to modify or delete browser-related artifacts.
Detects instances where a process named MsCache.exe deletes files within the Google Chrome User Data directory. This pattern may indicate unauthorized activity by a process masquerading as a cache-related utility to modify or delete browser-related artifacts.
Detects instances where a process named MsCache.exe deletes files within the Google Chrome User Data directory. This pattern may indicate unauthorized activity by a process masquerading as a cache-related utility to modify or delete browser-related artifacts.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
Page 476 of 756