Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
80 detections
Filters
Last updated
All Time
Detection languages
42
18
5
4
4
Contributors
29
9
6
5
4
Categories
21
17
16
16
15
Platforms
75
12
12
5
2
Products / Services
37
13
6
4
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
1
IDS Classtypes
2
1
IDS Protocols
3
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects the execution of a shortcut file named 'MicrosoftUpdateSerice.lnk', which is a common misspelling of 'MicrosoftUpdateService.lnk'. This technique is often used for evasive startup persistence by adversaries, as highlighted by its use in APT28/MuddyWater campaigns.
Detects scripts or commands that directly reference 'RtlDosPathNameToNtPathName' in their command line. This function can be used by adversaries for NT path evasion, a technique to manipulate how the operating system resolves file paths, potentially leading to execution of malicious files or bypassing security controls. The detection is based on the presence of this specific function name in process command lines.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects the loading of a malicious DLL by explorer.exe. This DLL is responsible for extracting a shellcode payload from a PNG file using steganography, a technique observed in the APT28 Phantom Net Voxel campaign.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Identifies process execution events or command lines that reference a Control Panel (.cpl) file hosted on a remote UNC path. This isolates the APT28 technique used in CVE-2026-21510 to load remote payloads as CPL objects.
Detects network connections to known LLM/AI API endpoints from processes that are not standard web browsers. This is indicative of the LAMEHUG malware used by APT28, which leverages these APIs to dynamically generate and execute commands.
Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).
Detects the creation of HTML files with specific formatting tags used by the SlimAgent keylogger, a tool used by Sednit (APT28).
Detects outbound network traffic to Icedrive domains from non-browser and non-Icedrive client processes, which could indicate C2 communication by the BeardShell implant used by Sednit (APT28).
Detects outbound network traffic to Filen domains from non-browser and non-Filen client processes, which could indicate C2 communication by Sednit's modified Covenant implant.
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
Detects Microsoft Edge launched with command-line arguments used to hide the browser window (headless mode or off-screen positioning) in conjunction with a Base64-encoded HTML data URI. This technique was observed in the APT28 "Operation MacroMaze" campaign to execute payloads stealthily.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects a Microsoft Office application creating script files with GUID-like names in the user's profile directory. This is the primary method used by the "Operation MacroMaze" macro to drop its initial set of malicious scripts onto the victim's machine.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Page 3 of 4