Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
203 detections
Filters
Last updated
All Time
Detection languages
76
72
13
12
8
Contributors
34
27
25
20
18
Categories
89
65
45
23
22
Platforms
173
30
21
6
3
Products / Services
42
40
26
7
5
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
5
1
1
1
IDS Classtypes
4
3
IDS Protocols
4
2
1
The rule detects the creation of processes that utilize specific mutex names associated with the WailingCrab backdoor. Specifically, it looks for a mutex named '823264'. This activity is indicative of the WailingCrab malware operating on a Windows system.
This rule detects the creation of specific mutexes known to be associated with the Toneshell backdoor. The rule looks for mutex names 'Fool87012900137' or 'Global\SingleCorporation12AD8B' during process creation events on Windows systems.
This rule detects the creation of specific mutexes associated with the ProjectWood backdoor. The detection is based on the presence of the mutex name 'IMPROVING CLIENT Want Wood To Exit?'. This activity is indicative of the ProjectWood backdoor running on a Windows system.
This rule detects the creation of specific mutexes known to be associated with the Proto8 backdoor. The mutex names include patterns like 'Global\sysmon-windows-<CRC32 of an MD5 hash of the victim's username>', 'Global\IntelGameSpeed-<CRC32 of an MD5 hash of the victim's username>', and 'Global\TencentSecuriryAgent-P01-<victim's username>'. The detection logic specifically looks for these exact mutex name strings, indicating a high confidence in identifying Proto8 backdoor activity.
The rule detects the creation of processes that utilize specific mutex names associated with the GoldenSpy backdoor. Specifically, it looks for the mutex 'nb_app_log_mutex'. The presence of this mutex indicates potential GoldenSpy backdoor activity on a Windows system.
This rule detects the creation of specific mutexes that are known to be associated with the CHIMNEYSWEEP backdoor. The mutex names monitored are 'rerunadmn', 'subttoadmn', 'runupdate', 'runupdateok', 'baserun', 'heyirunadmn', and 'corerun'. Detection of any of these mutexes indicates potential CHIMNEYSWEEP backdoor activity on a Windows system.
This rule detects the creation of specific mutexes associated with the Atharvan backdoor. The detection is triggered when a process creates a mutex named 'SAPTARISHI-ATHARVAN-101'. This activity is indicative of the Atharvan backdoor attempting to ensure only a single instance of itself is running on a system, a common technique for malware persistence and control.
The rule detects the creation of specific mutexes associated with Trojanized Plink backdoor activity. Specifically, it looks for a mutex named 'Global\WindowsSvchost'. The detection is based on process creation events where this mutex name is observed.
This rule detects the presence of specific mutex names ('dsds') that are known to be associated with the Nexe backdoor. The detection is based on process creation events in Windows environments. The Nexe backdoor is linked to the Patchwork APT group and is known for sophisticated evasion techniques. The rule aims to identify persistence mechanisms or active infections by this malware.
The rule detects the creation of specific mutexes associated with the LoptikMod backdoor. It specifically looks for a mutex named '08808'. The detection is based on process creation events in Windows environments.
This rule detects the creation of specific mutexes known to be associated with the GrimAgent backdoor. The detection logic specifically looks for a mutex named 'mymutex'. The primary goal is to identify GrimAgent activity, potentially indicating persistence or active infection.
The rule detects the presence of specific mutex names associated with the Glupteba backdoor. It looks for the mutexes 'Global\h48yorbq6rm87zot', 'Global\y7ze3fznx1u0yc2z', and 'Global\Mp6c3Ygukx29GbDk'. The detection is triggered if any of these mutexes are found, indicating potential Glupteba activity on a Windows system.
This rule detects the creation of processes that utilize specific mutex names associated with the FROSTRIFT backdoor. The detection is based on the presence of the mutex name '7d9196467986'. This activity is indicative of FROSTRIFT backdoor persistence or execution on a Windows system.
The rule detects the creation of specific mutex names associated with the FalseFront backdoor. It looks for the mutex '864H!NKLNB*x_H?5' during process creation events on Windows systems. The presence of this mutex indicates potential FalseFront backdoor activity, which is known for persistence mechanisms.
The rule detects the creation of processes that utilize specific mutex names associated with the AridGopher backdoor. It specifically looks for mutexes named 'ABCMedia' or 'SoftTookkitPSA'. This indicates potential activity of the AridGopher malware on a Windows system.
This rule detects the creation of specific mutexes associated with the TinyNote backdoor. The detection is triggered when a process creates a mutex named 'NASA&USA'. This activity is indicative of TinyNote backdoor persistence or execution on a Windows system.
This rule detects the creation of specific mutexes, 'Global\srvmutex' or 'SnipMutex', which are known to be associated with the SingleCamper backdoor. The detection is based on process creation events on Windows systems.
Detects known mutexes associated with SHELBY backdoor activity. Specifically, it looks for the mutex name 'Global\GHS<UniqueID>'.
The rule detects the creation of a process that utilizes specific mutex names ('VV.0') known to be associated with the RUDEBIRD backdoor. This indicates potential RUDEBIRD backdoor activity on the system.
The rule detects the creation of specific mutex names associated with the Kivars backdoor. It looks for mutexes matching the pattern 'uni-web-<uniqueid>'. This activity is indicative of the Kivars backdoor establishing persistence or coordinating its operations on a compromised system.
This rule detects the creation or presence of specific mutex names (`mstoolFtip32W`) that are known to be associated with the Eagerbee backdoor. The detection focuses on identifying these unique mutexes as indicators of Eagerbee activity on a Windows system, likely during process creation events.
Page 7 of 10