SecuInfra Falcon Team

Repository

https://github.com/SIFalcon/Detection

Commit

2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd

Retrieved

2026-09-27

Licence

No licence (all rights reserved)

Published

Metadata

Why

No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.

Rules from SecuInfra Falcon Team

• SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Metadata only

  Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Metadata only

  Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23Metadata only

  Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Metadata only

  Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_RANSOM_Magniber_LNK_Jan23Metadata only

  Detects Magniber Ransomware LNK files from fake Windows Update delivery method

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2023-01-13
• SECUINFRA_DROPPER_Njrat_VBSMetadata only

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_DROPPER_WSHRAT_Stage_1Metadata only

  Detects the first stage of WSHRAT as obfuscated JavaScript

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02
• SECUINFRA_MALWARE_Formbook_Filename_Stage_2Metadata only

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
• SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageMetadata only

  Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Metadata only

  Detects the ESXiArgs Ransomware encryption bash script

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23Metadata only

  Detects the ESXiArgs Ransomware 'encrypt' binary

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23Metadata only

  Detects the ESXiArgs Ransomware encryption bash script

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_APT_Bitter_Almond_RATMetadata only

  Detects Bitter (T-APT-17) Almond RAT (.NET)

  APT / threat actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01
• SECUINFRA_APT_Bitter_Maldoc_VerifyMetadata only

  Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)

  APT / threat actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01
• SECUINFRA_APT_Bitter_PDB_PathsMetadata only

  Detects Bitter (T-APT-17) PDB Paths

  APT / threat actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-22
• SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1Metadata only

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-21
• SECUINFRA_DROPPER_Valyria_Stage_1Metadata only

  Family was taken from VirusTotal

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-18
• SECUINFRA_MAL_Nw0RmMetadata only

  Detect the final RAT dropped by N-W0rm

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-03-02
• SECUINFRA_OBFUS_Powershell_ExecutionMetadata only

  Detects some variations of obfuscated PowerShell code to execute further PowerShell code

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_OBFUS_Powershell_Replace_TildeMetadata only

  Detects usage of Replace to replace tilde. Often observed in obfuscation

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
• SECUINFRA_OBFUS_VBS_Reverse_StartupMetadata only

  Detecs reversed StartUp Path. Sometimes used as obfuscation

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23Metadata only

  Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-01
• SECUINFRA_SUSP_Discord_Attachments_URLMetadata only

  Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
• SECUINFRA_SUSP_LNK_Staging_DirectoryMetadata only

  Detects typical staging directories being referenced inside lnk files

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_Netsh_Firewall_CommandMetadata only

  No description has been set in the source file - SecuInfra

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_Powershell_Download_Temp_RundllMetadata only

  Detect a Download to %temp% and execution with rundll32.exe

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Metadata only

  Detect a Download to %temp% and execution with rundll32.exe

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_SUSP_Reverse_Run_KeyMetadata only

  Detects a Reversed Run Key

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_MAL_NjratMetadata only

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_MAL_Redline_Certificate_BoschMetadata only

  Detects Certificate used by Redline Stealer

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02
• SECUINFRA_MAL_Redline_Certificate_GeforceMetadata only

  Detects Certificate used by Redline Stealer

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13
• SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMetadata only

  Detects a .NET Binary that downloads further payload and retrieves a special folder

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_DOTNET_PE_List_AVMetadata only

  Detecs .NET Binary that lists installed AVs

  Suspicious / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27