Rule Library
Sigma Rules
4 rules found for "Karneades"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
MMC Spawning Windows Shell
Detects a Windows command line executable started from MMC
WindowsProcess Creation
Karneades+1Mon Aug 05windows
Detectionmediumtest
Arbitrary File Download Via Squirrel.EXE
Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)+3Thu Jun 09windows
Detectionmediumtest
Process Proxy Execution Via Squirrel.EXE
Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)+3Thu Jun 09windows
Detectionhightest
Potential Persistence Via GlobalFlags
Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
WindowsRegistry Set
Karneades+2Wed Apr 11windows