Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
8
5
5
3
2
Contributors
5
5
4
3
2
Categories
14
10
10
5
4
Platforms
19
3
3
3
2
Products / Services
5
2
2
2
2
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
This rule detects the creation or modification of a registry run key that exhibits characteristics associated with the 'Small Sieve' malware. Specifically, it looks for a registry path containing '\Microsoft\Windows\CurrentVersion\Run\' combined with either the intentional typo 'Microsift' in the TargetObject or the string '.exe Platypus' in the Details field. These indicators are known to be used by the Small Sieve malware for persistence.
Detects the creation of specific files associated with the Small Sieve malware. This includes files with a characteristic typo ('Microsift' instead of 'Microsoft') in their path or a specific filename ('MicrosoftWindowsOutlookDataPlus.txt') in the AppData\Local directory, which are indicators of the Small Sieve malware's activity.
This rule detects the Domaiq Potentially Unwanted Application (PUA) by identifying a specific payload string and a combination of code patterns. These patterns include checks for NSIS (Nullsoft Scriptable Install System) integrity, UPX (Ultimate Packer for eXecutables) decompression and encryption, various dumping functions, and exception handling routines. The presence of these combined signatures indicates the likely presence of the Domaiq PUA.
Page 2 of 2