highstableEmerging Threat
Potential Emotet Activity
Detects all Emotet like process executions that are not covered by the more generic rules
windowsprocess_creation
2023-02-04
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
criticaltestEmerging Threat
Potential Emotet Rundll32 Execution
Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL
windowsprocess_creation
2023-02-21
hightestEmerging Threat
Potential Bumblebee Remote Thread Creation
Detects remote thread injection events based on action seen used by bumblebee
windowscreate_remote_thread
2022-09-27
hightestEmerging Threat
Emotet Loader Execution Via .LNK File
Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.
windowsprocess_creation
2024-08-15