Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
1
1
Categories
2
2
1
1
1
Platforms
4
Products / Services
3
1
MITRE Techniques
3
2
1
1
1
CVEs
71
71
64
58
49
Detects a suspected exploitation attempt of CVE-2024-21412. The rule identifies a chain of execution involving an internet shortcut (.url) masquerading as a common file type (e.g., .jpg.url), which subsequently opens another shortcut to a WebDAV/IP host. This sequence is used to bypass Mark-of-the-Web (MotW) protections and execute a malicious batch script and Rundll32 process.
Detects execution patterns associated with known Water Hydra exploit chains, specifically targeting CVE-2023-38831 (WinRAR self-extracting archive exploitation) and CVE-2024-21412 (Mark-of-the-Web/SmartScreen bypass via nested internet shortcuts). The rule monitors process lineage for WinRAR spawning command interpreters from temporary extraction directories and command line anomalies associated with rundll32.exe triggered from internet shortcut chains.
This analytic detects suspicious loading of the `vaultcli.dll` module by processes executing from publicly writable Windows directories. `vaultcli.dll` is known to be abused by information stealers, such as Meduza, to extract credentials from the Windows Credential Vault. The rule monitors for `ImageLoaded` events (Sysmon EventID 7) where `vaultcli.dll` is loaded by a process whose path is within common temporary, public, or other writable system directories. This behavior indicates potential credential theft attempts by malicious software.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
