Oysterloader Malware Detection

Daniel Jeremiah@daniyyell

•updated Feb 20, 2026•0•18

This rule set detects the OysterLoader malware. The first rule, 'OysterLoader_Mutex_and_TaskNames', identifies the malware based on specific mutex names, scheduled task names, and user-agent strings ('WordPressAgent' and 'FingerPrint') used by OysterLoader. The second rule, 'OysterLoader_C2_Endpoint_Strings', focuses on identifying OysterLoader by detecting specific C2 API paths used for communication with its command and control server. Both rules require the presence of a valid PE file header (MZ magic bytes).