SEKOIA.IO Community
- Repository
- https://github.com/SEKOIA-IO/Community
- Commit
- a438a5901a211c2abdf75da9c93921ef187473d1
- Retrieved
- 2026-09-27
- Licence
- Detection Rule License 1.1
- Published
- Full text
- Why
- Repository LICENSE.md is DRL 1.1 (redistribution allowed with attribution, link and licence indication).
Download pack (.yar, 706 rules)
Licence text (as retrieved by YARA Forge)
# Detection Rule License (DRL) 1.1
Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:
If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable
3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable
If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.Rules from SEKOIA.IO Community
Detects GobRat related files
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10Detects IceCache backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21Detects IceEvent Backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21Detects FPSpy, a backdoor used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Detects KLogExe, a keylogger used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects a PowerShell dropper used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky TODDLERSHARK vbs malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky validator
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11VBS files used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects PondRAT via mangled command names
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects strings of Queueseed/Kapeka malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-22Detect the TinyTurla-NG backdoor used by Turla
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-04Detect Kimsuky LNK
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-16Detect CobianRAT downloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-23Finds ACR Stealer standalone samples based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-04-22Finds Daolpu Stealer samples based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-23Finds Stealc standalone samples (or dumps) based on the strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-10-20Detects Koi Loader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detects NET ofbuscated Stealer used loaded by KoiLoader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20LNK file leading to deploy KoiLoader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Powershell script loading service.exe (related to Koi Loader)
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detect the JS script used to drop Latrodectus
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-25detection based on the exports
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-03Detects files related to the ShrinkLocker ransomware
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-07Xeno RAT is an open-source RAT, used by Kimsuky in January 2024
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detect MgBot credential stealer plugin
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detects obfuscation used by StrongPity
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-26Detects scanline (non-packed)
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-06Detect the LIGHTRAIL tunneler used by UNC1549
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-02-29Ursnif LDR4
MalwareSEKOIA.IO Community· Sekoia.io· 2024-12-19Detects obfuscation and string of APT37 stealer
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-02-27Detects Agent Racoon used by CL-STA-0002
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-12-05Detects APT37 Chinotto Powershell Variant
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-03-06Detects Rust Sysjoker variant via PDB path or key and Rust string
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects CommonMagic related implants
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects BadMagic DLL Loader powershell script
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects BOLDMOVE via strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-16Detects KamiKakaBot strings (.NET sample of Dark Pink)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-02-22Detects two parts of cmd.exe /c
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-06-05Detects the core of the VBS Gamaredon's Telegram Downloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-25Detects malicious LNK used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-09-11Script used to performs check before executing Konni
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects Konni dropper used when distributed via malicious document
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects timeCheck routine in LambLoad
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects MustangPanda malicious DLL
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-12-18Detects OilRig's Clipog stealer
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-10-24Detects entrypoint of shadowpad
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-30Detects SideCopy's ActionRAT (packer?)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-11Detects SideCopy's ReverseRAT
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-05-11Detects Class and Method names used inside ComLook
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-10-30New variant of Kazuar observed in 2023
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-11-03No description has been set in the source file - SEKOIA
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Detect Lazarus' malware ForestTiger
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Detect the RokRAT malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-07-11Detect Lazarus' RollSling malware (aka LazarLoader)
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Catch Kinsing malware based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-24Catch XORDDoS strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-02Detect the dotRunpeX crypter based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-08Detect the downloader used by Bluenoroff to install it CurlAgent
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-02Detect the DoNot's downloader malware. There are big binaries in downloader strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20Detect the CAB files used to drop the KONNI malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26Detects Ntospy based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2023-12-05Detects Stowaway based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2023-11-15Find loader module of Enigma Stealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-30Finds Lumma samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-14Finds Phoenix Stealer samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-20Finds StormKitty samples (or their variants) based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-29Finds Vidar samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-10Detect the DoNot's keylogger malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20Finds Amadey's clipper plugin based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16Finds standalone samples of Amadey based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-17Finds Amadey's stealer plugin based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16Finds Latrodectus samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-08Finds JinxLoader samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-04Detect the BAT files (named trap.bat or yup.bat) used by KONNI
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26This rule detect samples that are downloaded on the GobRAT C2 URL path /a, /b and /c.
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-09Detect the KONNI RAT DLL files (x32 and x64)
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26Detect RATel based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-04-24DEPRECATED : Find Remcos RAT samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-29Detect SideCopy's ReverseRAT v3 observed in January 2023
MalwareSEKOIA.IO Community· Sekoia.io· 2023-02-22Detect the mobile backdoor using the name used in the certificate
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-16No description has been set in the source file - SEKOIA
Hack toolSEKOIA.IO Community· Sekoia.io· 2023-08-23Detect the Agniane stealer using strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-10Statc Downloader powershell script. Base64 powershell
MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-09Specific string for HUI Loader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-04Detects malicious VBA used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Detects compromised Chrome SecurePreferences file
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the DevTool module used by SharpExt
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the exfiltration JS code of SharpExt
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the PHP code of the SharpTongue C2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects SharpTongue variants.
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS Launchers used by SharpTongue
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS/Powershell Downloader used by Kimsuky
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Rule based on structure offsets and file extension
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-12Detects BLINDINGCAN with RTTI
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-10-04Detects VHD ransomware downloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28Detects VHD ransomware x64 loader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28Detects Muddy's Mori Agent implant
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-01-14Detects stacked strings used in the wiper.
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-04-06Detects OlympicDestroyer malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-04-15Detects APT28 graphite malware based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-27Detects Tmanger malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-09-06Detects the IIS SessionManager backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-07-04Detect HeaderTip backdoor used by the Chinese threat actor Scarab. This backdoor has its hardcoded C2 in strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-25Detect the BUMBLEBEE loader
MalwareSEKOIA.IO Community· Sekoia.io· 2022-05-23Detects an sLoad downloader based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-02Detects njRAT based on some strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-22Detects Mac/Win/Linux EarthWorm based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2022-02-08Detects Mimikatz on strings obfuscation
Hack toolSEKOIA.IO Community· Sekoia.io· 2022-07-22Detect the Flagpro malware used by Blacktech
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-22Finds Havoc implants based on the embedded default strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-07Finds Aurora botnet samples based on characteristic strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-21Detect Mars Stealer variand llcppc1
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-10Detect Mars Stealer based on a specific XOR routine
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-06Finds Nosu samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-15Detect Raccoon based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-03Finds SolarMarker DLL based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09Finds SolarMarker PowerShell script based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09Detect the open-source StormKitty spyware by looking for the github path
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20Detect the Vidar infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-26Detect the Vulturi infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-14Rule based on structure offset and file extension
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-12Detect BUMBLEBEE based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-08Detect the GCleaner loader using specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-11Finds samples of the SVCReady loader
MalwareSEKOIA.IO Community· Sekoia.io· 2022-06-08Detects RemCom based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-30Detect AvosLocker ransomware for Linux by using strings from its ransom note and the onion domains
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-21Detect the BlackCat ransomware (Windows version)
MalwareSEKOIA.IO Community· Sekoia.io· 2022-01-19Detect the Lorenz ransomware
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-10Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28Detect TinyFluff backdoor by OldGremlin
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20Detects HTran based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2022-09-09Detects the JuicyPotato exploit based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2022-09-09Detects Unicorn Powershell
Hack toolSEKOIA.IO Community· Sekoia.io· 2022-08-23Detects malicious VBScript executed by LNK/mshta
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-24Finds AcridRain samples
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-21Detect the Squirrelwaffle DLL
MalwareSEKOIA.IO Community· Sekoia.io· 2021-09-20Detect AvosLocker ransomware (2021-07)
MalwareSEKOIA.IO Community· Sekoia.io· 2021-08-03Detect the Fonix / XINOF ransomware by spotting its specific debug path
MalwareSEKOIA.IO Community· Sekoia.io· 2021-10-07Detect the Karma ransomware payload
MalwareSEKOIA.IO Community· Sekoia.io· 2021-08-25Finds Aurora samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-11-15Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Detects Stealerium based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-01Detect the X-FILES infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-03Detects PDB path of some Dark Pink sample
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2023-01-16Matches the routine which decrypts the RSA key blob in the Graphite downloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-01-26Detects Dora RAT based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects one of the Andariel keylogger
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects Nestdoor based on (weak) strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects WalkerShell used by APT-K-47
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-14Detects APT28 document phishing webpage
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-08Detects APT28 Phishing page
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-02Detects APT28's Wayzgoose exploit strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-29Detects malicious RDP files
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-25Detects malicious HTA used by APT29 to drop Wineloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-25Detects malicious PDF used by APT29 to drop Wineloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-25Detects APT33 Tickler malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-08-29Detects a dropper used by keyplug
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-12Detects a simple downloader abusing wlrmdr.exe and used by APT-C-60
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-05Detects APT-K-47's Asyncshell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects APT-K-47 malicious LNK
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects custom variant of Merlin agent used by BackdoorDiplomaty
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-06Detects PhantomNet based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-06Detects DropboxFlop malware
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-04Detects YK0130 reverse shell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-04Detects COATHANGER beacon
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-07Detects COATHANGER files
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-07Detects a simple win implant used by Cotton Sandstorm
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-05Detects downloader used by Evasive Panda (certificate.exe)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-15Detects DLL used by Evasive Panda
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-15Detects malicious LNK used by FlightNight
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-02Detects HTML Smuggling webpages of Gamaredon used in 2024
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects lnk file used by Gamaredon
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-08SUBTLE-PAWS powershell backdoor used by Gamaredon
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects Gelsemium's FireWood backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane launcher
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane rootkit
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects XDealer linux variant
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects stealer module of XDealer
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects XDealer based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects XDealer VBS Launcher
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects InvisibleFerret based on common ressource.
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-28Detects strings in PocoProxy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-08-13Detects MuddyC2Go DLL launcher
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-07Detects RotRot backdoor based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects a webshell used by OilRig
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-23Detects RedHotel's malicious LNKs
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects stealer used by RusticWeb
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-01-09Detects PDB path of Cheex
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-08-14Detects malicious HTA used by SPIKEDWINE
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-29Detects vineloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-29Detects FlowCloud Loader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-05-27Detects TomBerBil password stealer
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-23Detects WAExp based on strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-23Detects loader of ToneShell (exception based)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-02Detects first bytes of ToneShell used to call the shellcode or the code to check the MagicNumber (0x17 0x03 0x03)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-02Detects powershell script (explorer.ps1)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-01Detects reverse base64 files (explorer.ps1)
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-02-01Detects BatCopier variant
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects a malicious LNK used by an APT
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects UTA0178 malicious inclusion strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-01-12Detects UPSTYLE backdoor
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-04-16Detects Dex files containing GuardZoo strings.
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-08-09Detect the Bifrost backdor based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-05Detect the Supershell client (unpacked) by looking for github references
MalwareSEKOIA.IO Community· Sekoia.io· 2024-04-25Detects files related to the Oyster backdoor.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-29Detect the Sponsor backdoor
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-29Catch Lucifer DDoS - lin version - malware based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-24'Search.exe' script used by APT42
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-23Finds SelfAU3 Dropper samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-12Emmenhtal Loader string
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects ez-pwnkit exploit
ExploitSEKOIA.IO Community· Sekoia.io· 2024-01-22LNK file delivering Guloader
GenericSEKOIA.IO Community· Sekoia.io· 2024-02-07Powershell downloading decoy and delivering GuLoader
GenericSEKOIA.IO Community· Sekoia.io· 2024-02-07GuLoader Unpacker
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07GuLoader Unpacker b64 decoded
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07visual basic script delivering GuLoader
GenericSEKOIA.IO Community· Sekoia.io· 2024-02-07Finds ChromeKatz (CookieKatz version) standalone samples based on the strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-10-30Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Monster Stealer stub (Python payload) based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-07Finds XehookStealer standalone samples based on specific strings.
GenericSEKOIA.IO Community· Sekoia.io· 2024-06-12Finds XenoStealer standalone samples based on the strings
GenericSEKOIA.IO Community· Sekoia.io· 2024-10-30Kill-Floor strings
GenericSEKOIA.IO Community· Sekoia.io· 2024-10-29Powershell script loading obfuscated .NET Koi module
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-03-20Finds FakeBat initial PowerShell script downloading and executing the next-stage payload.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-05-28Finds FakeBat PowerShell script fingerprinting the infected host.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-21Detect ABCloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-19Finds PowerShell scripts used in a malvertising campaign to deliver NetSupport RAT
MalwareSEKOIA.IO Community· Sekoia.io· 2024-05-03Detects some malicious LNK
GenericSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects HTTPShell based on URL patterns
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects Swordldr. Maybe chunk_1 is too restrictive
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-25Detects TinyShell based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-04Detects ValleyRat 1stage
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-11Detects ValleyRat downloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-11ValleyRAT strings based on HIVE KEYS and config.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-19Detects XMRig EXE
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-04Detects files related to stage 1 of a campaign from the ransomware group RA World.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-24DarkVision RAT based on string
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-17Detect the open-source RAT TutClient
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects Diamorphine linux rootkit based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-10-21No description has been set in the source file - SEKOIA
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects files used in a campaign performed by the intrusion set Storm-1811
GenericSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects 3proxy based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects AdvancedRun strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects payload of BypassGodzilla
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects Cheat Engine driver
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-07-22Detects Chisel
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects Dog Tunnel based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects EDRSandblast API strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects EDRSandblast CLI strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects EDRSandblast KernelCallbacks strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-11-25Detects EDRSandblast strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects enum4linux based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-02-02Detects ExecIT Dlls
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-11Detects reverse shell
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-04-16Detects Gsocket based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects Impersonate
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-07-24Detects In-Swor based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects iodine based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-02-02Detects Koblas server
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects Lsass dump based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects MultiDump
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-19Detects nssm tool
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects Pivotnacci
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-04-22Detects pivotnacci webshell
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-04-22Detects RATHole based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects RealBlindingEDR based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-11Detects revsocks client
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-07Detects Rubeus
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects standard implementation of RunPEInMemory
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects SharpNBTScan based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects SOAPHound based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-11-12Detects SSF based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-05-31Detects swor
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects TacticalRMM installer
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects TokenPlayer based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-11-04Detects b374k webshell
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-06No description has been set in the source file - SEKOIA
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-11Finds gosecretsdump EXE based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-06-10Finds sharpshares EXE based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-06-10Finds Snap2HTML samples based on specific strings. Legitimate tool used by ransomware affiliates to perform discovery
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-02-08Detects XiebroC2 based on strings
Hack toolSEKOIA.IO Community· Sekoia.io· 2024-09-11Matches node-r-control, asr_node, node-relay
GenericSEKOIA.IO Community· Sekoia.io· 2024-08-20Matches netd binary
GenericSEKOIA.IO Community· Sekoia.io· 2024-08-23Reverse shell used by Quad7 operators
GenericSEKOIA.IO Community· Sekoia.io· 2024-08-19Detects the xlogin bind shell and its variants
GenericSEKOIA.IO Community· Sekoia.io· 2024-07-18Detects the (x|r|a)login bind shells
GenericSEKOIA.IO Community· Sekoia.io· 2024-07-18Ursnif Payload
GenericSEKOIA.IO Community· Sekoia.io· 2024-12-19Detect the open-source SoftEther VPN
GenericSEKOIA.IO Community· Sekoia.io· 2024-04-15Detects IOCs related to the 8220 Mining group.
GenericSEKOIA.IO Community· Sekoia.io· 2024-06-11