SecuInfra Falcon Team
- Repository
- https://github.com/SIFalcon/Detection
- Commit
- 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
- Abgerufen
- 2026-09-27
- Lizenz
- No licence (all rights reserved)
- Veröffentlicht
- Metadaten
- Begründung
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Regeln von SecuInfra Falcon Team
- SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Nur Metadaten
Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16 - SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Nur Metadaten
Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21 Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21- SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Nur Metadaten
Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21 - SECUINFRA_RANSOM_Magniber_LNK_Jan23Nur Metadaten
Detects Magniber Ransomware LNK files from fake Windows Update delivery method
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2023-01-13 - SECUINFRA_DROPPER_Njrat_VBSNur Metadaten
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_DROPPER_WSHRAT_Stage_1Nur Metadaten
Detects the first stage of WSHRAT as obfuscated JavaScript
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02 - SECUINFRA_MALWARE_Formbook_Filename_Stage_2Nur Metadaten
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageNur Metadaten
Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Nur Metadaten
Detects the ESXiArgs Ransomware encryption bash script
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23Nur Metadaten
Detects the ESXiArgs Ransomware 'encrypt' binary
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23Nur Metadaten
Detects the ESXiArgs Ransomware encryption bash script
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_APT_Bitter_Almond_RATNur Metadaten
Detects Bitter (T-APT-17) Almond RAT (.NET)
APT / AkteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01 - SECUINFRA_APT_Bitter_Maldoc_VerifyNur Metadaten
Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)
APT / AkteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01 - SECUINFRA_APT_Bitter_PDB_PathsNur Metadaten
Detects Bitter (T-APT-17) PDB Paths
APT / AkteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-22 - SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1Nur Metadaten
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-21 - SECUINFRA_DROPPER_Valyria_Stage_1Nur Metadaten
Family was taken from VirusTotal
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-18 - SECUINFRA_MAL_Nw0RmNur Metadaten
Detect the final RAT dropped by N-W0rm
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-03-02 - SECUINFRA_OBFUS_Powershell_ExecutionNur Metadaten
Detects some variations of obfuscated PowerShell code to execute further PowerShell code
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_OBFUS_Powershell_Replace_TildeNur Metadaten
Detects usage of Replace to replace tilde. Often observed in obfuscation
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02 - SECUINFRA_OBFUS_VBS_Reverse_StartupNur Metadaten
Detecs reversed StartUp Path. Sometimes used as obfuscation
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23Nur Metadaten
Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-01 - SECUINFRA_SUSP_Discord_Attachments_URLNur Metadaten
Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_SUSP_LNK_Staging_DirectoryNur Metadaten
Detects typical staging directories being referenced inside lnk files
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_Netsh_Firewall_CommandNur Metadaten
No description has been set in the source file - SecuInfra
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_Powershell_Download_Temp_RundllNur Metadaten
Detect a Download to %temp% and execution with rundll32.exe
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Nur Metadaten
Detect a Download to %temp% and execution with rundll32.exe
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Reverse_Run_KeyNur Metadaten
Detects a Reversed Run Key
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_MAL_NjratNur Metadaten
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_MAL_Redline_Certificate_BoschNur Metadaten
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceNur Metadaten
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13 - SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderNur Metadaten
Detects a .NET Binary that downloads further payload and retrieves a special folder
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_DOTNET_PE_List_AVNur Metadaten
Detecs .NET Binary that lists installed AVs
Verdächtig / HuntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27