SecuInfra Falcon Team

Dépôt

https://github.com/SIFalcon/Detection

Commit

2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd

Récupéré le

2026-09-27

Licence

No licence (all rights reserved)

Publication

Métadonnées

Justification

No LICENSE file in the repository and no licence statement in its README (checked 2026-09-29). Without a grant, the rules are all rights reserved: metadata and an upstream link only.

Règles de SecuInfra Falcon Team

• SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23Métadonnées seules

  Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-03-16
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23Métadonnées seules

  Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23Métadonnées seules

  Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23Métadonnées seules

  Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-06-21
• SECUINFRA_RANSOM_Magniber_LNK_Jan23Métadonnées seules

  Detects Magniber Ransomware LNK files from fake Windows Update delivery method

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2023-01-13
• SECUINFRA_DROPPER_Njrat_VBSMétadonnées seules

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_DROPPER_WSHRAT_Stage_1Métadonnées seules

  Detects the first stage of WSHRAT as obfuscated JavaScript

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02
• SECUINFRA_MALWARE_Formbook_Filename_Stage_2Métadonnées seules

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
• SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageMétadonnées seules

  Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23Métadonnées seules

  Detects the ESXiArgs Ransomware encryption bash script

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23Métadonnées seules

  Detects the ESXiArgs Ransomware 'encrypt' binary

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23Métadonnées seules

  Detects the ESXiArgs Ransomware encryption bash script

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-07
• SECUINFRA_APT_Bitter_Almond_RATMétadonnées seules

  Detects Bitter (T-APT-17) Almond RAT (.NET)

  APT / acteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01
• SECUINFRA_APT_Bitter_Maldoc_VerifyMétadonnées seules

  Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)

  APT / acteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-01
• SECUINFRA_APT_Bitter_PDB_PathsMétadonnées seules

  Detects Bitter (T-APT-17) PDB Paths

  APT / acteurSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2022-06-22
• SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1Métadonnées seules

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-21
• SECUINFRA_DROPPER_Valyria_Stage_1Métadonnées seules

  Family was taken from VirusTotal

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-18
• SECUINFRA_MAL_Nw0RmMétadonnées seules

  Detect the final RAT dropped by N-W0rm

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-03-02
• SECUINFRA_OBFUS_Powershell_ExecutionMétadonnées seules

  Detects some variations of obfuscated PowerShell code to execute further PowerShell code

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_OBFUS_Powershell_Replace_TildeMétadonnées seules

  Detects usage of Replace to replace tilde. Often observed in obfuscation

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-10-02
• SECUINFRA_OBFUS_VBS_Reverse_StartupMétadonnées seules

  Detecs reversed StartUp Path. Sometimes used as obfuscation

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23Métadonnées seules

  Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team (@SI_FalconTeam)· 2023-02-01
• SECUINFRA_SUSP_Discord_Attachments_URLMétadonnées seules

  Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
• SECUINFRA_SUSP_LNK_Staging_DirectoryMétadonnées seules

  Detects typical staging directories being referenced inside lnk files

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_Netsh_Firewall_CommandMétadonnées seules

  No description has been set in the source file - SecuInfra

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_Powershell_Download_Temp_RundllMétadonnées seules

  Detect a Download to %temp% and execution with rundll32.exe

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1Métadonnées seules

  Detect a Download to %temp% and execution with rundll32.exe

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-09-02
• SECUINFRA_SUSP_Reverse_Run_KeyMétadonnées seules

  Detects a Reversed Run Key

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_MAL_NjratMétadonnées seules

  No description has been set in the source file - SecuInfra

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_MAL_Redline_Certificate_BoschMétadonnées seules

  Detects Certificate used by Redline Stealer

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02
• SECUINFRA_MAL_Redline_Certificate_GeforceMétadonnées seules

  Detects Certificate used by Redline Stealer

  MalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-13
• SECUINFRA_SUSP_DOTNET_PE_Download_To_SpecialfolderMétadonnées seules

  Detects a .NET Binary that downloads further payload and retrieves a special folder

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
• SECUINFRA_SUSP_DOTNET_PE_List_AVMétadonnées seules

  Detecs .NET Binary that lists installed AVs

  Suspect / chasseSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27