sigma-rules

Search for Antivirus process

Sep 20, 2024 ·
Share on:

Search for Antivirus process

Read More
Capture Wi-Fi password

Aug 14, 2024 ·
Share on:

Capture Wi-Fi password

Read More
Disable power options

Mar 11, 2024 ·
Share on:

Disable power options

Read More
Stop EventLog

Mar 11, 2024 ·
Share on:

Stop EventLog

Read More
Uninstall MRT(Malicious Software Removal Tool)

Mar 11, 2024 ·
Share on:

Uninstall MRT(Malicious Software Removal Tool)

Read More
Dot net compiler compiles file from suspicious location

Feb 5, 2024 ·
Share on:

Dot net compiler compiles file from suspicious location

Read More
Access payload via nslookup txt record

Dec 14, 2023 ·
Share on:

Access payload via nslookup txt record

Read More
DarkGate

Oct 26, 2023 ·
Share on:

DarkGate Downloader

Read More
Powershell download and load assembly

Aug 23, 2023 ·
Share on:

Detect powershell download and load assembly

Read More
Xmrig

Aug 8, 2023 ·
Share on:

Detect Xmrig

Read More
Powershell download and execute file

Jul 21, 2023 ·
Share on:

powershell download file from internet and execute

Read More
Register Jar In Run Key

Jun 21, 2023 ·
Share on:

register jar in run key

Read More
Set custom UserAgent and download file via Powershell

May 30, 2023 ·
Share on:

Set Custom UserAgent and download file via Powershell

Read More
Set autostart key via New-ItemProperty Cmdlet

Mar 21, 2023 ·
Share on:

Set autostart key via New-ItemProperty Cmdlet

Read More
ONENOTE drops suspicious file

Jan 13, 2023 ·
Share on:

ONENOTE drops suspicious file

Read More
Powershell Download and Execute IEX

Nov 21, 2022 ·
Share on:

powershell download file from internet and execute

Read More
MedusaLocker

Nov 11, 2022 ·
Share on:

MedusaLocker key

Read More
Remcos

Nov 9, 2022 ·
Share on:

detect log.dat of remcos and registry entry

Read More
Sodinokibi

Nov 2, 2022 ·
Share on:

Sodinokibi random extension key

Read More
Copy file to startup via Powershell

Oct 28, 2022 ·
Share on:

Copy file to startup via Powershell

Read More
Stop multiple services

Oct 11, 2022 ·
Share on:

Stop multiple services

Read More
Powershell drops NetSupport RAT client

Aug 30, 2022 ·
Share on:

Powershell drops NetSupport RAT client

Read More
VjW0rm

Aug 30, 2022 ·
Share on:

VjW0rm Registry key

Read More
Drops script at startup location

Mar 15, 2022 ·
Share on:

Drops script at startup location

Read More
bitsadmin download and execute

Dec 10, 2021 ·
Share on:

Detect bitsadmin download and execute activity

Read More
Execute DLL with spoofed extension

Oct 15, 2021 ·
Share on:

Execute DLL with spoofed extension

Read More
Powershell Decrypt And Execute Base64 Data

Sep 30, 2021 ·
Share on:

powershell decrypts and execute hardcoded base64 blob

Read More
Drops fake system file at system root drive

Aug 13, 2021 ·
Share on:

Drops fake system file at system root drive

Read More
Powershell run code from registry

Aug 12, 2021 ·
Share on:

Powershell run code from registry

Read More
Run CertUtil from suspicious location

Jul 30, 2021 ·
Share on:

Run CertUtil from suspicious location

Read More
LimeRAT

Jul 22, 2021 ·
Share on:

LimeRAT

Read More
Scheduled temp file as task from temp location

Jun 28, 2021 ·
Share on:

Scheduled temp file as task from temp location

Read More
msiexec download and execute

May 25, 2021 ·
Share on:

msiexec download and execute

Read More
Schedule system process

May 19, 2021 ·
Share on:

Schedule system process

Read More
Add file from suspicious location to autostart registry

May 3, 2021 ·
Share on:

Add file from suspicious location to autostart registry

Read More
AntiVM

May 3, 2021 ·
Share on:

Detect virtual environment "VirtualBox|VMware|KVM|HVM"

Read More
AppLocker Bypass via Regsvr32

May 3, 2021 ·
Share on:

AppLocker Bypass via Regsvr32

Read More
Check external IP via Powershell

May 3, 2021 ·
Share on:

Check external IP via Powershell

Read More
Check privilege of CMD via whoami

May 3, 2021 ·
Share on:

Check privilege of CMD via whoami

Read More
Copy itself to suspicious location via type command

May 3, 2021 ·
Share on:

Copy itself to suspicious location via type command

Read More
Credwiz util dropped by mshta for dll sideloading

May 3, 2021 ·
Share on:

Credwiz util dropped by mshta for dll sideloading

Read More
Decode DLL Via Certutil

May 3, 2021 ·
Share on:

Decode DLL Via Certutil

Read More
Decode strings from lnk via findstr.exe

May 3, 2021 ·
Share on:

uses findstr.exe to decode strings from lnk file

Read More
Delete Shadow Copy Via Powershell

May 3, 2021 ·
Share on:

Delete Shadow Copy Via Powershell

Read More
Delete shadow copy via WMIC

May 3, 2021 ·
Share on:

Delete shadow copy via WMIC

Read More
Drops a DLL with WLL extension to the startup

May 3, 2021 ·
Share on:

Drops a DLL with WLL extension to the startup

Read More
EQNEDT32.EXE connecting to internet

May 3, 2021 ·
Share on:

EQNEDT32.EXE connecting to internet

Read More
Exe Launched By ReflectiveLoader Dll

May 3, 2021 ·
Share on:

exe launched by dll with ReflectiveLoader export function

Read More
Execute dll with txt extension from temp location

May 3, 2021 ·
Share on:

Execute dll with txt extension from temp location

Read More
Execute Script with spoofed extension

May 3, 2021 ·
Share on:

Execute Script with spoofed extension

Read More
Execute Scriptlet from internet Via Regsvr32

May 3, 2021 ·
Share on:

regsvr32.exe to execute a COM scriptlet from internet

Read More
Execute Scriptlet Via Regsvr32

May 3, 2021 ·
Share on:

regsvr32.exe to execute a COM scriptlet

Read More
File Dropped By EQNEDT32EXE

May 3, 2021 ·
Share on:

File dropped by EQNEDT32.EXE(CVE-2017-11882)

Read More
Fodhelper UAC Bypass

May 3, 2021 ·
Share on:

Fodhelper UAC Bypass

Read More
Geofenced Ru

May 3, 2021 ·
Share on:

Detect region and exit if matched with harcoded country list Get-UICulture).Name -match "CN|RO|RU|UA|BY

Read More
Get antivirus details via WMIC query

May 3, 2021 ·
Share on:

Get antivirus details via WMIC query

Read More
Hide copy and delete itself

May 3, 2021 ·
Share on:

Hide copy via attrib.exe and delete itself

Read More
IcedID Downloader

May 3, 2021 ·
Share on:

IcedID Downloader

Read More
Kill multiple process

May 3, 2021 ·
Share on:

Kill multiple process

Read More
MSBuild connects to smtp port

May 3, 2021 ·
Share on:

MSBuild connects to smtp port

Read More
MSBuild execute suspicous task

May 3, 2021 ·
Share on:

MSBuild execute suspicous task

Read More
MSBuild Launched By Scr

May 3, 2021 ·
Share on:

Code injection in msbuild.exe by .scr file

Read More
Mshta Download Pastebin

May 3, 2021 ·
Share on:

mshta downloads payload from pastebin

Read More
NanoCore

May 3, 2021 ·
Share on:

detect run.dat of NanoCore

Read More
NetWire

May 3, 2021 ·
Share on:

NetWire auto-start registry entry

Read More
Office product drops executable at suspicious location

May 3, 2021 ·
Share on:

Office product drops executable at suspicious location

Read More
Office product drops script at suspicious location

May 3, 2021 ·
Share on:

Office product drops script at suspicious location

Read More
Powershell add exclusion path, extension and process

May 3, 2021 ·
Share on:

Powershell add exclusion path, extension and process

Read More
Powershell adding suspicious path to exclusion list

May 3, 2021 ·
Share on:

Powershell adding suspicious path to exclusion list

Read More
Powershell create lnk in startup

May 3, 2021 ·
Share on:

Powershell create lnk in startup

Read More
Powershell delayed execution via ping command

May 3, 2021 ·
Share on:

Powershell delayed execution via ping command

Read More
Powershell download file and shellexecute

May 3, 2021 ·
Share on:

Powershell download file and shellexecute

Read More
Powershell download file from base64 url

May 3, 2021 ·
Share on:

Powershell download file from base64 url

Read More
Powershell download payload from hardcoded c2 list

May 3, 2021 ·
Share on:

Powershell download payload from hardcoded c2 list

Read More
Powershell execute code from registry

May 3, 2021 ·
Share on:

Powershell execute code from registry

Read More
Powershell IEX Download In Base64

May 3, 2021 ·
Share on:

powershell IEX((new-object net.webclient).downloadstring( string in base64 form

Read More
Powershell launch wmic via class

May 3, 2021 ·
Share on:

Powershell launch wmic via class

Read More
Powershell launch wscript

May 3, 2021 ·
Share on:

Powershell launch wscript

Read More
Powershell Launched By Winword

May 3, 2021 ·
Share on:

powershell with enco parameter launched by winword / excel / powerpoint

Read More
Powershell load assembly from internet

May 3, 2021 ·
Share on:

Powershell load assembly from internet

Read More
Powershell load assembly from registry

May 3, 2021 ·
Share on:

Powershell load assembly from registry

Read More
powershell registry execution via wmic

May 3, 2021 ·
Share on:

Detect powershell registry execution via wmic

Read More
Quasar

May 3, 2021 ·
Share on:

Quasar

Read More
ReflectiveLoader

May 3, 2021 ·
Share on:

ReflectiveLoader

Read More
RegAsm connects to smtp port

May 3, 2021 ·
Share on:

RegAsm connects to smtp port

Read More
Register dll at autostart location via regsvr32

May 3, 2021 ·
Share on:

Register dll at autostart location via regsvr32

Read More
Register Wscript In Run Key

May 3, 2021 ·
Share on:

Registering wscript to autostart run key for dropped js/vbs

Read More
Rename system process and copy to suspicious location

May 3, 2021 ·
Share on:

Rename system process and copy to suspicious location

Read More
Renamed MSHTA launching html

May 3, 2021 ·
Share on:

Renamed MSHTA launching html

Read More
RMSRemoteAdmin

May 3, 2021 ·
Share on:

RMS RemoteAdmin tool

Read More
Run temp file via regsvr32

May 3, 2021 ·
Share on:

Run temp file via regsvr32

Read More
rundll32 launch mshta and run script from internet

May 3, 2021 ·
Share on:

Detect rundll32 launch mshta and run script from internet

Read More
rundll32 run dll from internet

May 3, 2021 ·
Share on:

rundll32 run dll from internet

Read More
Ryuk

May 3, 2021 ·
Share on:

Ryuk sending magic Wake-On-Lan packet on port 7

Read More
Schedule binary from dotnet directory

May 3, 2021 ·
Share on:

Schedule binary from dotnet directory

Read More
Schedule CERTUTIL windows binary

May 3, 2021 ·
Share on:

Schedule CERTUTIL windows binary

Read More
Schedule REGSVR windows binary

May 3, 2021 ·
Share on:

Schedule REGSVR windows binary

Read More
Schedule script as task

May 3, 2021 ·
Share on:

Schedule script as task

Read More
Schedule script from internet via mshta

May 3, 2021 ·
Share on:

Schedule script from internet via mshta

Read More
Schedule VBS From Appdata

May 3, 2021 ·
Share on:

Schedule vb script From Appdata

Read More
Shedule powershell with encoded command parameter

May 3, 2021 ·
Share on:

Shedule powershell with encoded command parameter

Read More
Steal Google chrome login data

May 3, 2021 ·
Share on:

Steal Google chrome login data

Read More
Wake-On-Lan

May 3, 2021 ·
Share on:

Sending magic Wake-On-Lan packet on port 7

Read More
Winword Drops Script In Startup

May 3, 2021 ·
Share on:

Winword.exe drops script file in startup location

Read More
Wmic download via msiexec

May 3, 2021 ·
Share on:

Wmic download via msiexec

Read More
Wmic Launch Msiexec

May 3, 2021 ·
Share on:

Wmic launch msiexec to download file from internet

Read More
wmic launch powershell and execute encrypted script

May 3, 2021 ·
Share on:

Detect wmic launch powershell and execute encrypted script

Read More
Wmic Launch regsvr32

May 3, 2021 ·
Share on:

Wmic launch regsvr32

Read More
WMIC launch script from xsl file

May 3, 2021 ·
Share on:

WMIC launch script from xsl file

Read More
WScript Launched By Powershell

May 3, 2021 ·
Share on:

powershell launches WScript, WScript executes file from startup

Read More