Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
3
1
1
Categories
2
1
1
1
1
Platforms
5
Products / Services
3
1
MITRE Techniques
3
3
3
3
3
CVEs
71
71
64
58
49
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
KQL Query
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
