SEKOIA.IO Community
- Repositorio
- https://github.com/SEKOIA-IO/Community
- Commit
- a438a5901a211c2abdf75da9c93921ef187473d1
- Obtenido
- 2026-09-27
- Licencia
- Detection Rule License 1.1
- Publicación
- Texto completo
- Motivo
- Repository LICENSE.md is DRL 1.1 (redistribution allowed with attribution, link and licence indication).
Descargar paquete (.yar, 706 reglas)
Texto de la licencia (tal como lo obtuvo YARA Forge)
# Detection Rule License (DRL) 1.1
Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:
If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable
3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable
If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:
1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.Reglas de SEKOIA.IO Community
Detects GobRat related files
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-10Detects IceCache backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-21Detects IceEvent Backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-21Detects FPSpy, a backdoor used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Detects KLogExe, a keylogger used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-27Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects a PowerShell dropper used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-11Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky TODDLERSHARK vbs malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-06Detects Kimsuky validator
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-11VBS files used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects PondRAT via mangled command names
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-23Detects strings of Queueseed/Kapeka malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-22Detect the TinyTurla-NG backdoor used by Turla
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-04Detect Kimsuky LNK
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-16Detect CobianRAT downloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-23Finds ACR Stealer standalone samples based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-04-22Finds Daolpu Stealer samples based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-23Finds Stealc standalone samples (or dumps) based on the strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-10-20Detects Koi Loader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detects NET ofbuscated Stealer used loaded by KoiLoader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20LNK file leading to deploy KoiLoader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Powershell script loading service.exe (related to Koi Loader)
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detect the JS script used to drop Latrodectus
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-25detection based on the exports
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-03Detects files related to the ShrinkLocker ransomware
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-07Xeno RAT is an open-source RAT, used by Kimsuky in January 2024
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detect MgBot credential stealer plugin
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-20Detects obfuscation used by StrongPity
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-26Detects scanline (non-packed)
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-06Detect the LIGHTRAIL tunneler used by UNC1549
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-02-29Ursnif LDR4
MalwareSEKOIA.IO Community· Sekoia.io· 2024-12-19Detects obfuscation and string of APT37 stealer
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-02-27Detects Agent Racoon used by CL-STA-0002
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-12-05Detects APT37 Chinotto Powershell Variant
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-03-06Detects Rust Sysjoker variant via PDB path or key and Rust string
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects CommonMagic related implants
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects CommonMagic related implants
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects BadMagic DLL Loader powershell script
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-15Detects BOLDMOVE via strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-01-16Detects KamiKakaBot strings (.NET sample of Dark Pink)
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-02-22Detects two parts of cmd.exe /c
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-06-05Detects the core of the VBS Gamaredon's Telegram Downloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-01-25Detects malicious LNK used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-09-11Script used to performs check before executing Konni
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects Konni dropper used when distributed via malicious document
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects timeCheck routine in LambLoad
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-11-27Detects MustangPanda malicious DLL
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-12-18Detects OilRig's Clipog stealer
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-10-24Detects entrypoint of shadowpad
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-01-30Detects SideCopy's ActionRAT (packer?)
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-11Detects SideCopy's ReverseRAT
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-05-11Detects Class and Method names used inside ComLook
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-10-30New variant of Kazuar observed in 2023
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-11-03No description has been set in the source file - SEKOIA
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Detect Lazarus' malware ForestTiger
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Detect the RokRAT malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-07-11Detect Lazarus' RollSling malware (aka LazarLoader)
MalwareSEKOIA.IO Community· Sekoia.io· 2023-10-24Catch Kinsing malware based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-24Catch XORDDoS strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-02Detect the dotRunpeX crypter based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-08Detect the downloader used by Bluenoroff to install it CurlAgent
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-02Detect the DoNot's downloader malware. There are big binaries in downloader strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20Detect the CAB files used to drop the KONNI malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26Detects Ntospy based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2023-12-05Detects Stowaway based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2023-11-15Find loader module of Enigma Stealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-30Finds Lumma samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-14Finds Phoenix Stealer samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-20Finds StormKitty samples (or their variants) based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-29Finds Vidar samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-11-10Detect the DoNot's keylogger malware
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-20Finds Amadey's clipper plugin based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16Finds standalone samples of Amadey based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-17Finds Amadey's stealer plugin based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-05-16Finds Latrodectus samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-08Finds JinxLoader samples based on the specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-12-04Detect the BAT files (named trap.bat or yup.bat) used by KONNI
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26This rule detect samples that are downloaded on the GobRAT C2 URL path /a, /b and /c.
MalwareSEKOIA.IO Community· Sekoia.io· 2023-06-09Detect the KONNI RAT DLL files (x32 and x64)
MalwareSEKOIA.IO Community· Sekoia.io· 2023-09-26Detect RATel based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-04-24DEPRECATED : Find Remcos RAT samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-29Detect SideCopy's ReverseRAT v3 observed in January 2023
MalwareSEKOIA.IO Community· Sekoia.io· 2023-02-22Detect the mobile backdoor using the name used in the certificate
MalwareSEKOIA.IO Community· Sekoia.io· 2023-01-16No description has been set in the source file - SEKOIA
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2023-08-23Detect the Agniane stealer using strings
MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-10Statc Downloader powershell script. Base64 powershell
MalwareSEKOIA.IO Community· Sekoia.io· 2023-08-09Specific string for HUI Loader
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-04Detects malicious VBA used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Detects compromised Chrome SecurePreferences file
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the DevTool module used by SharpExt
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the exfiltration JS code of SharpExt
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects the PHP code of the SharpTongue C2
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects SharpTongue variants.
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS Launchers used by SharpTongue
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-29Detects VBS/Powershell Downloader used by Kimsuky
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-08-30Rule based on structure offsets and file extension
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-09-12Detects BLINDINGCAN with RTTI
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-10-04Detects VHD ransomware downloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-11-28Detects VHD ransomware x64 loader
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-11-28Detects Muddy's Mori Agent implant
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-01-14Detects stacked strings used in the wiper.
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-04-06Detects OlympicDestroyer malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-04-15Detects APT28 graphite malware based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-09-27Detects Tmanger malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-09-06Detects the IIS SessionManager backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-07-04Detect HeaderTip backdoor used by the Chinese threat actor Scarab. This backdoor has its hardcoded C2 in strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-25Detect the BUMBLEBEE loader
MalwareSEKOIA.IO Community· Sekoia.io· 2022-05-23Detects an sLoad downloader based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-02Detects njRAT based on some strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-22Detects Mac/Win/Linux EarthWorm based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2022-02-08Detects Mimikatz on strings obfuscation
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2022-07-22Detect the Flagpro malware used by Blacktech
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-22Finds Havoc implants based on the embedded default strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-07Finds Aurora botnet samples based on characteristic strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-21Detect Mars Stealer variand llcppc1
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-10Detect Mars Stealer based on a specific XOR routine
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-06Finds Nosu samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-15Detect Raccoon based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-03Finds SolarMarker DLL based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09Finds SolarMarker PowerShell script based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-09Detect the open-source StormKitty spyware by looking for the github path
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20Detect the Vidar infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-07-26Detect the Vulturi infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-14Rule based on structure offset and file extension
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-12Detect BUMBLEBEE based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-08Detect the GCleaner loader using specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-10-11Finds samples of the SVCReady loader
MalwareSEKOIA.IO Community· Sekoia.io· 2022-06-08Detects RemCom based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-08-30Detect AvosLocker ransomware for Linux by using strings from its ransom note and the onion domains
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-21Detect the BlackCat ransomware (Windows version)
MalwareSEKOIA.IO Community· Sekoia.io· 2022-01-19Detect the Lorenz ransomware
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-10Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details.
MalwareSEKOIA.IO Community· Sekoia.io· 2022-03-28Detect TinyFluff backdoor by OldGremlin
MalwareSEKOIA.IO Community· Sekoia.io· 2022-04-20Detects HTran based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2022-09-09Detects the JuicyPotato exploit based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2022-09-09Detects Unicorn Powershell
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2022-08-23Detects malicious VBScript executed by LNK/mshta
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-01-24Finds AcridRain samples
MalwareSEKOIA.IO Community· Sekoia.io· 2023-03-21Detect the Squirrelwaffle DLL
MalwareSEKOIA.IO Community· Sekoia.io· 2021-09-20Detect AvosLocker ransomware (2021-07)
MalwareSEKOIA.IO Community· Sekoia.io· 2021-08-03Detect the Fonix / XINOF ransomware by spotting its specific debug path
MalwareSEKOIA.IO Community· Sekoia.io· 2021-10-07Detect the Karma ransomware payload
MalwareSEKOIA.IO Community· Sekoia.io· 2021-08-25Finds Aurora samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-11-15Finds Redline samples based on characteristic strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-09-07Detects Stealerium based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-12-01Detect the X-FILES infostealer based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2022-02-03Detects PDB path of some Dark Pink sample
APT / actorSEKOIA.IO Community· Sekoia.io· 2023-01-16Matches the routine which decrypts the RSA key blob in the Graphite downloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2022-01-26Detects Dora RAT based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects one of the Andariel keylogger
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects Nestdoor based on (weak) strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-17Detects WalkerShell used by APT-K-47
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-14Detects APT28 document phishing webpage
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-08Detects APT28 Phishing page
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-02Detects APT28's Wayzgoose exploit strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-29Detects malicious RDP files
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-25Detects malicious HTA used by APT29 to drop Wineloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-25Detects malicious PDF used by APT29 to drop Wineloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-25Detects APT33 Tickler malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-08-29Detects a dropper used by keyplug
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-12Detects a simple downloader abusing wlrmdr.exe and used by APT-C-60
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-05Detects APT-K-47's Asyncshell
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects APT-K-47 malicious LNK
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects custom variant of Merlin agent used by BackdoorDiplomaty
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-06Detects PhantomNet based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-06Detects DropboxFlop malware
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-04Detects YK0130 reverse shell
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-04Detects COATHANGER beacon
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-07Detects COATHANGER files
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-07Detects a simple win implant used by Cotton Sandstorm
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-05Detects downloader used by Evasive Panda (certificate.exe)
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-15Detects DLL used by Evasive Panda
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-15Detects malicious LNK used by FlightNight
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-02Detects HTML Smuggling webpages of Gamaredon used in 2024
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects lnk file used by Gamaredon
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-08SUBTLE-PAWS powershell backdoor used by Gamaredon
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects Gelsemium's FireWood backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane launcher
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects Gelsemium's WolfsBane rootkit
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects XDealer linux variant
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects stealer module of XDealer
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects XDealer based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects XDealer VBS Launcher
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects InvisibleFerret based on common ressource.
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-28Detects strings in PocoProxy
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-08-13Detects MuddyC2Go DLL launcher
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-03-07Detects RotRot backdoor based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects a webshell used by OilRig
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-23Detects RedHotel's malicious LNKs
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects stealer used by RusticWeb
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-01-09Detects PDB path of Cheex
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-08-14Detects malicious HTA used by SPIKEDWINE
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-29Detects vineloader
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-29Detects FlowCloud Loader
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-05-27Detects TomBerBil password stealer
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-23Detects WAExp based on strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-23Detects loader of ToneShell (exception based)
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-02Detects first bytes of ToneShell used to call the shellcode or the code to check the MagicNumber (0x17 0x03 0x03)
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-10-02Detects powershell script (explorer.ps1)
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-01Detects reverse base64 files (explorer.ps1)
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-02-01Detects BatCopier variant
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects a malicious LNK used by an APT
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects UTA0178 malicious inclusion strings
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-01-12Detects UPSTYLE backdoor
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-04-16Detects Dex files containing GuardZoo strings.
APT / actorSEKOIA.IO Community· Sekoia.io· 2024-08-09Detect the Bifrost backdor based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-05Detect the Supershell client (unpacked) by looking for github references
MalwareSEKOIA.IO Community· Sekoia.io· 2024-04-25Detects files related to the Oyster backdoor.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-29Detect the Sponsor backdoor
MalwareSEKOIA.IO Community· Sekoia.io· 2024-03-29Catch Lucifer DDoS - lin version - malware based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-24'Search.exe' script used by APT42
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-23Finds SelfAU3 Dropper samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-12Emmenhtal Loader string
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects ez-pwnkit exploit
ExploitSEKOIA.IO Community· Sekoia.io· 2024-01-22LNK file delivering Guloader
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-02-07Powershell downloading decoy and delivering GuLoader
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-02-07GuLoader Unpacker
Sospechoso / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07GuLoader Unpacker b64 decoded
Sospechoso / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07visual basic script delivering GuLoader
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-02-07Finds ChromeKatz (CookieKatz version) standalone samples based on the strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-10-30Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Geacon samples based on specific strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-11Finds Monster Stealer stub (Python payload) based on specific strings.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-07Finds XehookStealer standalone samples based on specific strings.
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-06-12Finds XenoStealer standalone samples based on the strings
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-10-30Kill-Floor strings
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-10-29Powershell script loading obfuscated .NET Koi module
Sospechoso / huntingSEKOIA.IO Community· Sekoia.io· 2024-03-20Finds FakeBat initial PowerShell script downloading and executing the next-stage payload.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-05-28Finds FakeBat PowerShell script fingerprinting the infected host.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-21Detect ABCloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-19Finds PowerShell scripts used in a malvertising campaign to deliver NetSupport RAT
MalwareSEKOIA.IO Community· Sekoia.io· 2024-05-03Detects some malicious LNK
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-11-22Detects HTTPShell based on URL patterns
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects Swordldr. Maybe chunk_1 is too restrictive
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-25Detects TinyShell based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-04Detects ValleyRat 1stage
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-11Detects ValleyRat downloader
MalwareSEKOIA.IO Community· Sekoia.io· 2024-06-11ValleyRAT strings based on HIVE KEYS and config.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-08-19Detects XMRig EXE
MalwareSEKOIA.IO Community· Sekoia.io· 2024-01-04Detects files related to stage 1 of a campaign from the ransomware group RA World.
MalwareSEKOIA.IO Community· Sekoia.io· 2024-07-24DarkVision RAT based on string
MalwareSEKOIA.IO Community· Sekoia.io· 2024-09-17Detect the open-source RAT TutClient
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects Diamorphine linux rootkit based on strings
MalwareSEKOIA.IO Community· Sekoia.io· 2024-10-21No description has been set in the source file - SEKOIA
MalwareSEKOIA.IO Community· Sekoia.io· 2024-02-09Detects files used in a campaign performed by the intrusion set Storm-1811
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects 3proxy based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects AdvancedRun strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects payload of BypassGodzilla
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects Cheat Engine driver
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-07-22Detects Chisel
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects Dog Tunnel based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-14Detects EDRSandblast API strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects EDRSandblast CLI strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects EDRSandblast KernelCallbacks strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-11-25Detects EDRSandblast strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-01-08Detects enum4linux based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-02-02Detects ExecIT Dlls
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-11Detects reverse shell
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-04-16Detects Gsocket based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-06-10Detects Impersonate
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-07-24Detects In-Swor based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects iodine based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-02-02Detects Koblas server
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects Lsass dump based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects MultiDump
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-19Detects nssm tool
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-06Detects Pivotnacci
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-04-22Detects pivotnacci webshell
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-04-22Detects RATHole based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects RealBlindingEDR based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-11Detects revsocks client
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-07Detects Rubeus
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-03-22Detects standard implementation of RunPEInMemory
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects SharpNBTScan based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects SOAPHound based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-11-12Detects SSF based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-05-31Detects swor
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-09Detects TacticalRMM installer
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-05-23Detects TokenPlayer based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-11-04Detects b374k webshell
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-06No description has been set in the source file - SEKOIA
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-11Finds gosecretsdump EXE based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-06-10Finds sharpshares EXE based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-06-10Finds Snap2HTML samples based on specific strings. Legitimate tool used by ransomware affiliates to perform discovery
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-02-08Detects XiebroC2 based on strings
Herramienta ofensivaSEKOIA.IO Community· Sekoia.io· 2024-09-11Matches node-r-control, asr_node, node-relay
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-08-20Matches netd binary
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-08-23Reverse shell used by Quad7 operators
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-08-19Detects the xlogin bind shell and its variants
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-07-18Detects the (x|r|a)login bind shells
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-07-18Ursnif Payload
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-12-19Detect the open-source SoftEther VPN
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-04-15Detects IOCs related to the 8220 Mining group.
GenéricaSEKOIA.IO Community· Sekoia.io· 2024-06-11