Matches rule Hidden Tear Ransomware by Ariel Millahuel at SOC Prime Threat Detection Marketplace
According to Wikipedia Hidden Tear is the first open-source ransomware trojan that targets computers running Microsoft Windows
View rule
View matches
Matches rule PsiXBot Malware behavior by Ariel Millahuel at SOC Prime Threat Detection Marketplace
This malware that has spying capabilities and also, this one can record audio and video from the victim's machine.
Matches rule Orcus RAT detection by Ariel Millahuel at SOC Prime Threat Detection Marketplace
Orcus is a Remote Access Trojan capable of loading custom plugins created by the people that buys him
Matches rule Startup Folder File Write by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) at Sigma Integrated Rule Set (GitHub)
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Matches rule Load Of RstrtMgr.DLL By An Uncommon Process by Luc Génaux at Sigma Integrated Rule Set (GitHub)
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process. This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows. It could also be used for anti-analysis purposes by shut downing specific processes.
Matches rule Proxy Execution Via Explorer.exe by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative at Sigma Integrated Rule Set (GitHub)
Attackers can use explorer.exe for evading defense mechanisms