Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
4
4
2
1
1
Platforms
5
2
2
Products / Services
2
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
Detects a process launched from an OpenClaw skill enumerating debugger, packet-capture, process-monitoring, sandbox, or virtual-machine utilities before payload execution. This behavior is indicative of malware attempting to identify analysis environments.
Detects pip installing the benign-looking termncolor package together with colorinal. This dependency relationship was used to conceal delivery of platform-specific ZiChatBot droppers, as observed in campaigns attributed to OceanLotus (APT32). The rule specifically looks for command-line executions of pip or python with 'pip install' and the presence of 'termncolor', 'colorinal', or 'uuid32-utils' in the command line.
Detects a small Go-based scanner, identified by its renamed executable 'go.exe', when launched with command-line arguments indicative of broad network scanning activities such as CIDR range specifications (/16, /24), service discovery, or exploit module usage. This behavior is often associated with initial access or reconnaissance phases by adversaries.
End-to-end correlation: Fake AI installer executes -> Drops pythonw.exe -> Network connection to Vidar C2.
Identifies when DeepLoad target processes (LockAppHost.exe, makecab.exe, Magnify.exe) spawn child processes like shells (cmd.exe, powershell.exe, whoami.exe, net.exe), indicating successful injection and post-exploitation execution. This behavior is associated with the DeepLoad malware.