Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
23
15
12
6
5
Contributors
15
13
8
5
5
Categories
31
23
17
8
6
Platforms
59
5
5
5
Products / Services
26
23
16
12
6
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
4
1
IDS Protocols
5
Detects a game-delivered backdoor spawning cmd.exe with a command line unrelated to installation or game launch activity. The rule specifically looks for cmd.exe being spawned by processes with names containing 'bird', 'rok', 'game', 'launcher', 'update', 'python', or 'ruby', and executing a command line with '/c'.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Detects a loader writing an encrypted data component and immediately querying hostname, processor, or volume identifiers used to derive a machine-specific decryption key. This behavior is indicative of malware, such as RokRAT, attempting to create a system-specific payload to evade detection or ensure persistence.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects a Python runtime (such as userscreen.exe or python.exe) executing a file with a .cat extension. This technique is used by APT37 NarwhalRAT to conceal Python bytecode payloads.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Detects the execution of 'userscreen.exe', which is the masqueraded name used for 'pythonw.exe' by APT37's NarwhalRAT. This defense evasion technique hides the Python console window and blends in with legitimate system processes before loading its fileless payload into memory.
Detects the execution of a process named 'userscreen.exe' that is actually a masqueraded 'pythonw.exe', a technique used by APT37 NarwhalRAT. Detecting the masqueraded Python execution is critical for stopping NarwhalRAT before it can load its fileless payload into memory.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
Detects the creation of specific scheduled tasks known to be used by ScarCruft (APT37) to establish persistence for NarwhalRAT. The rule looks for scheduled task creation events (EventID 4698 in SecurityEvent logs or ActionType 'ScheduledTaskCreated' in DeviceEvents) where the task name matches known malicious task names used by ScarCruft, specifically 'MicrosoftUserInterfacePicturesUpdateTackMachine' and 'MicrosoftMusicLibrariesPackageTaskMachine'.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule identifies the use of xcopy.exe with a combination of flags (/s, /e, /y, /c, /q, /h, /b) that are characteristic of NarwhalRAT's data staging activities from removable media.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern. The rule looks for 'schtasks.exe' being executed with '/create' or '-create' flags and the unique task name 'MicrosoftUserInterfacePicturesUpdateTackMachine'. It covers process creation events from DeviceProcessEvents, SecurityEvent (EventID 4688), and Sysmon (EventID 1).
Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects command-line obfuscation via Windows environment variable substring expansion (%var:~offset,length%), an evasion technique used by APT37 in the Operation Deepfake/HumanitarianBait-adjacent campaigns to reconstruct malicious commands at runtime and bypass static command-line scanning. This rule catches both the APT37-specific single-character extraction pattern (,1%) and the broader high-count substring-expansion pattern that any obfuscated command exhibits regardless of chunk size. It also flags cmd.exe /k invocation, which APT37 commonly uses.
Detects network connections to known Command and Control (C2) infrastructure associated with the APT37 Ruby Jumper campaign. This includes the C2 IP address for the FOOTWINE backdoor and the Zoho WorkDrive Client ID used by the RESTLEAF implant for exfiltration.
Detects the creation of files within hidden folders on removable media that are designed to mimic the Windows Recycle Bin ($RECYCLE.BIN or $RECYCLE.BIN.USER). This technique is used by APT37's THUMBSBD and VIRUSTASK malware to stage malicious files (.rb, .dat) for bridging air-gapped networks.
Detects the creation of a Ruby runtime environment in unusual ProgramData subdirectories and the renaming of the Ruby interpreter to masquerade as a USB utility, a technique used by APT37's SNAKEDROPPER malware. Specifically looks for file events in 'C:\ProgramData\usbspeed' or 'C:\ProgramData\ruby3' where the filename is 'usbspeed.exe' or the previous filename was 'rubyw.exe'.
Page 2 of 4