Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
5
Contributors
3
1
1
Categories
2
2
1
1
1
Platforms
5
Products / Services
4
1
MITRE Techniques
3
3
3
3
3
CVEs
71
71
64
58
49
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
A DefenderXDR Custom Detection for CVE-2025-56383
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.
