Sigma Rules
15 rules found for "oscd.community"
ZxShell Malware
Detects a ZxShell start by the called and well-known function name
Adwind RAT / JRAT
Detects javaw.exe in AppData folder as used by Adwind / JRAT
CosmicDuke Service Installation
Detects the installation of a service named "javamtsup" on the system. The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
WannaCry Ransomware Activity
Detects WannaCry ransomware activity
Sofacy Trojan Loader Activity
Detects Trojan loader activity as used by APT28
OilRig APT Activity
Detects OilRig activity as reported by Nyotron in their March 2018 report
OilRig APT Registry Persistence
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
OilRig APT Schedule Task Persistence - Security
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
OilRig APT Schedule Task Persistence - System
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Exploiting SetupComplete.cmd CVE-2019-1378
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Potential Dridex Activity
Detects potential Dridex acitvity via specific process patterns
Formbook Process Creation
Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.
LockerGoga Ransomware Activity
Detects LockerGoga ransomware activity via specific command line.
Mustang Panda Dropper
Detects specific process parameters as used by Mustang Panda droppers
Winnti Pipemon Characteristics
Detects specific process characteristics of Winnti Pipemon malware reported by ESET