SecuInfra Falcon Team
- Repositorio
- https://github.com/SIFalcon/Detection
- Commit
- 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
- Obtenido
- 2026-09-27
- Licencia
- No licence (all rights reserved)
- Publicación
- Metadatos
- Motivo
- No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.
Reglas de SecuInfra Falcon Team
- SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Solo metadatos
Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16 - SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Solo metadatos
Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21 - SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23Solo metadatos
Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21 - SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Solo metadatos
Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21 - SECUINFRA_RANSOM_Magniber_LNK_Jan23Solo metadatos
Detects Magniber Ransomware LNK files from fake Windows Update delivery method
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2023-01-13 - SECUINFRA_DROPPER_Njrat_VBSSolo metadatos
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_DROPPER_WSHRAT_Stage_1Solo metadatos
Detects the first stage of WSHRAT as obfuscated JavaScript
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02 - SECUINFRA_MALWARE_Formbook_Filename_Stage_2Solo metadatos
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageSolo metadatos
Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Solo metadatos
Detects the ESXiArgs Ransomware encryption bash script
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23Solo metadatos
Detects the ESXiArgs Ransomware 'encrypt' binary
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23Solo metadatos
Detects the ESXiArgs Ransomware encryption bash script
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07 - SECUINFRA_APT_Bitter_Almond_RATSolo metadatos
Detects Bitter (T-APT-17) Almond RAT (.NET)
APT / actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01 - SECUINFRA_APT_Bitter_Maldoc_VerifySolo metadatos
Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)
APT / actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01 - SECUINFRA_APT_Bitter_PDB_PathsSolo metadatos
Detects Bitter (T-APT-17) PDB Paths
APT / actorSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-22 - SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1Solo metadatos
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-21 - SECUINFRA_DROPPER_Valyria_Stage_1Solo metadatos
Family was taken from VirusTotal
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-18 - SECUINFRA_MAL_Nw0RmSolo metadatos
Detect the final RAT dropped by N-W0rm
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-03-02 - SECUINFRA_OBFUS_Powershell_ExecutionSolo metadatos
Detects some variations of obfuscated PowerShell code to execute further PowerShell code
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_OBFUS_Powershell_Replace_TildeSolo metadatos
Detects usage of Replace to replace tilde. Often observed in obfuscation
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02 - SECUINFRA_OBFUS_VBS_Reverse_StartupSolo metadatos
Detecs reversed StartUp Path. Sometimes used as obfuscation
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23Solo metadatos
Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-01 - SECUINFRA_SUSP_Discord_Attachments_URLSolo metadatos
Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19 - SECUINFRA_SUSP_LNK_Staging_DirectorySolo metadatos
Detects typical staging directories being referenced inside lnk files
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_Netsh_Firewall_CommandSolo metadatos
No description has been set in the source file - SecuInfra
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_Powershell_Download_Temp_RundllSolo metadatos
Detect a Download to %temp% and execution with rundll32.exe
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Solo metadatos
Detect a Download to %temp% and execution with rundll32.exe
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02 - SECUINFRA_SUSP_Reverse_Run_KeySolo metadatos
Detects a Reversed Run Key
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_MAL_NjratSolo metadatos
No description has been set in the source file - SecuInfra
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_MAL_Redline_Certificate_BoschSolo metadatos
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02 - SECUINFRA_MAL_Redline_Certificate_GeforceSolo metadatos
Detects Certificate used by Redline Stealer
MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13 - SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderSolo metadatos
Detects a .NET Binary that downloads further payload and retrieves a special folder
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27 - SECUINFRA_SUSP_DOTNET_PE_List_AVSolo metadatos
Detecs .NET Binary that lists installed AVs
Sospechoso / huntingSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27