Achmad Adhikara
@adhikara130 followers2,266 downloads13 copies0 likes2,531 views
206 detections
Filters
Last updated
All Time
Detection languages
206
Categories
206
Platforms
206
MITRE Techniques
98
94
34
33
27
This rule detects the creation of specific mutexes known to be associated with the RedLine stealer malware. The detection is triggered when a process creates a mutex named 'winter750'.
This rule detects the creation of specific mutex names associated with Claimloader malware activity. The mutex names observed include patterns like 'TB<yearmonthdate>', 'MTM<yearmonthdate>', 'CATM<yearmonthdate>', and fixed strings such as 'GameBoxABC', 'GameGpu0428', 'GameFind057', and 'GameBoxTV59'. Detection relies on monitoring process creation events for these specific mutex names, indicating potential Claimloader execution or presence on a Windows system.
The rule detects the creation of a process that utilizes specific mutex names associated with XieBroRAT malware. Specifically, it looks for the mutex name 'pLONGFEIFFmm1'. This indicates potential XieBroRAT activity on a Windows system, likely related to its command and control or persistence mechanisms. The detection is based on process creation events where these mutex names are observed.
The rule detects the presence of specific mutex names ('kwnmsgyyay') that are known to be associated with the WhiteSnake stealer malware. This detection is based on monitoring process creation events for these particular mutexes.
This rule detects the presence of specific mutex names associated with WannaCry ransomware activity. The rule looks for processes creating or interacting with mutexes named 'MsWinZonesCacheCounterMutexA' or 'Global\MsWinZonesCacheCounterMutexW'. These mutexes are known indicators of WannaCry infection.
The rule detects the creation of specific mutex names associated with VanHelsing ransomware. It looks for the mutex 'Global\VanHelsing'.
This rule detects the creation of specific mutexes known to be associated with the Toneshell backdoor. The rule looks for mutex names 'Fool87012900137' or 'Global\SingleCorporation12AD8B' during process creation events on Windows systems.
This rule detects the creation of specific mutex names associated with Suncrypt ransomware. The detection is based on a direct match of known, unique mutex strings, indicating the presence or activity of Suncrypt ransomware on a Windows system.
This rule detects the creation of specific mutexes known to be associated with the Stealc stealer malware. The rule specifically looks for mutex names 'GentleSpade' and '5rjtejk5rytrr'. The presence of these mutexes indicates potential Stealc stealer activity on a Windows system.
The rule detects the creation of processes that utilize specific mutex names known to be associated with the Sharp Dragon loader. Specifically, it looks for the mutex name 'mt_app_http_get_zed2vsp'. This indicates potential Sharp Dragon malware execution on a Windows system.
Page 5 of 21