Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
33
9
8
4
2
Contributors
9
7
7
6
6
Categories
30
13
9
9
7
Platforms
46
5
4
Products / Services
24
7
5
2
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
Detects Discord Update.exe launching Discord through the processStart switch when started by an unusual parent. This behavior is indicative of potential malware, such as VVS Stealer, which might replace Discord core files and then use this method to load injected JavaScript into a fresh application session.
Detects execution or file activity involving SHA-256 hashes attributed to analyzed VVS Discord Stealer samples. This rule provides high-confidence indicator coverage and should be retained as supporting intelligence alongside the behavioral detections in this pack.
Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.
This YARA rule detects the Arkanix Stealer by identifying specific strings found within its code or related artifacts. It looks for a combination of unique user agent strings, domain names associated with its command and control infrastructure, API endpoints used for session creation or data exfiltration, a secret key, and a staging identifier. The rule requires at least one domain, one endpoint, and one of the distinctive user agent, key, or staging hints to trigger, aiming to reduce false positives by combining multiple indicators.
Detects the PowerShell download cradle used by the Marco Stealer malware.
Detects network connections to a known Amatera Stealer C2 IP address where the HTTP Host header is spoofed. This technique is used by the malware to masquerade its C2 traffic, often by using a legitimate-looking or unrelated domain in the Host header, while communicating directly with the malicious IP address.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
This analytic detects suspicious loading of the `vaultcli.dll` module by processes executing from publicly writable Windows directories. `vaultcli.dll` is known to be abused by information stealers, such as Meduza, to extract credentials from the Windows Credential Vault. The rule monitors for `ImageLoaded` events (Sysmon EventID 7) where `vaultcli.dll` is loaded by a process whose path is within common temporary, public, or other writable system directories. This behavior indicates potential credential theft attempts by malicious software.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
Page 2 of 3