Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
80 detections
Filters
Last updated
All Time
Detection languages
42
18
5
4
4
Contributors
29
9
6
5
4
Categories
21
17
16
16
15
Platforms
75
12
12
5
2
Products / Services
37
13
6
4
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
1
IDS Classtypes
2
1
IDS Protocols
3
This rule detects file creation and process execution events associated with specific SHA256 hashes linked to the APT28 threat actor exploiting CVE-2026-21509.
Detects unauthorized processes modifying the registry value 'PONT_STRING' within the Outlook Options General key. This registry value controls the display of content download warnings in Microsoft Outlook. Modifying this key from a non-Outlook process is a technique used by threat actors, such as APT28, to bypass security warnings and facilitate the execution of malicious payloads or content within Outlook.
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
This rule monitors for the creation of specific file artifacts associated with the APT28 SimpleLoader malware, including malicious DLLs, steganographic image payloads, and configuration files dropped into non-standard or diagnostic directories.
Detects network and DNS activity involving domains known to be used by the threat actor APT28 for command and control, specifically for hosting WebDAV payloads, malicious LNK files, and weaponized documents.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects network and DNS activity involving domains known to be used by the threat actor APT28 for command and control, specifically for hosting WebDAV payloads, malicious LNK files, and weaponized documents.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
Detects unauthorized processes modifying the registry value 'PONT_STRING' within the Outlook Options General key. This registry value controls the display of content download warnings in Microsoft Outlook. Modifying this key from a non-Outlook process is a technique used by threat actors, such as APT28, to bypass security warnings and facilitate the execution of malicious payloads or content within Outlook.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
This rule monitors for the creation of specific file artifacts associated with the APT28 SimpleLoader malware, including malicious DLLs, steganographic image payloads, and configuration files dropped into non-standard or diagnostic directories.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
Detects scripts combining AllocConsole and ConsoleWindowClass to explicitly hide application windows. This technique can be used by adversaries to conceal their malicious activity.
Page 2 of 4