Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
24
18
11
10
2
Contributors
20
15
9
7
5
Categories
29
13
12
10
9
Platforms
53
12
1
1
1
Products / Services
21
16
10
10
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
7
3
IDS Protocols
10
The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This detection leverages the Endpoint.Filesystem datamodel to monitor file creation events in the specified directory. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
Detects the modification of registry keys under HKLM or HKCU classes related to COM objects, specifically the InprocServer32 subkey, where the default value is changed to point to a DLL in common user-writable locations such as AppData, Temp, or ProgramData. This behavior is indicative of COM Hijacking used for persistence, as observed in Turla (Secret Blizzard) campaigns.
Detects registry modifications to CLSID InprocServer32 keys where the referenced DLL path resides in a non-standard, user-writable directory (e.g., AppData, Temp, ProgramData, Public, Recycle.Bin). This technique, known as COM Hijacking (T1546.015), is used by the Turla (also known as Snake, Secret Blizzard, Uroburos) threat group to achieve persistence by redirecting legitimate COM object references to malicious payloads.
Detects HTTP GET requests to a specific file path (docs.zip) on the Ukrainian government website (drs.gov.ua), identified as an activity associated with the Turla threat group's STOCKSTAY malware component.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
Detects the execution of RDP files (mstsc.exe) initiated by common application vectors (email clients, browsers, archive utilities) from suspicious user-writable paths like Temp, Downloads, or AppData directories. This behavior is consistent with Turla group's phishing delivery chain where malicious RDP files are used for persistence or lateral movement.
Detects mshta.exe spawning from archive utilities (winrar.exe, 7z.exe) or Windows Explorer, or executing HTA files directly from common user-writable temporary or download directories. This pattern is commonly associated with the execution of malicious payloads delivered via compressed archives, a technique observed in campaigns attributed to the Turla threat group.
Detects outbound WebSocket connections from endpoints to known infrastructure associated with the Turla group's STOCKSTAY malware. The rule monitors DeviceNetworkEvents for successful connections or attempts to specific domains (glitch.me, onrender.com, theworkpc.com) or connections containing WebSocket-related headers in the metadata, which indicate C2 activity.
Detects mshta.exe spawning from archive utilities (winrar.exe, 7z.exe) or Windows Explorer, or executing HTA files directly from common user-writable temporary or download directories. This pattern is commonly associated with the execution of malicious payloads delivered via compressed archives, a technique observed in campaigns attributed to the Turla threat group.
This rule detects WebSocket upgrade attempts to 'google-ai-labs-it.onrender.com', which is associated with the Turla group's STOCKSTAY malware C2 infrastructure.
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects the execution or file creation of identified Turla STOCKSTAY malware components, specifically targeting a list of known malicious filenames and installers used by this actor.
Detects path traversal exploitation of WinRAR (CVE-2025-8088) where a malicious RAR archive extraction results in the creation of suspicious STOCKSTAY payload files (e.g., MicrosoftUpdateOneDrive.exe) outside of the expected or secure extraction directories, linked to Turla activity.
Detects HTTP traffic patterns associated with the Turla STOCKSTAY malware establishing a WebSocket connection to the known C2 domain 'wool-basalt-clock.glitch.me'. The rule monitors for a GET request containing specific HTTP headers (Upgrade: websocket) required for protocol switching to WebSocket, which is a common technique for establishing persistent C2 channels.
Detects HTTP GET requests for specific malicious archives (calculator.rar, EditorToolsPdf.zip) originating from suspected compromised Ukrainian domains (basecon.com.ua, online.zp.ua). This behavior is associated with the STOCKSTAY malware used by the threat actor Turla.
Detects HTTP traffic patterns associated with the Turla STOCKSTAY malware establishing a WebSocket connection to the known C2 domain 'wool-basalt-clock.glitch.me'. The rule monitors for a GET request containing specific HTTP headers (Upgrade: websocket) required for protocol switching to WebSocket, which is a common technique for establishing persistent C2 channels.
Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.
Detects the Turla threat group's STOCKSTAY malware establishing persistence by creating a registry entry in the HKCU Run key. The persistence mechanism points to 'MicrosoftUpdateOneDrive.exe' located in the '%LOCALAPPDATA%\Programs\SMN\' directory.
Detects the creation of ZIP/RAR/7z archives by processes residing within the Turla STOCKSTAY installation directory (%LOCALAPPDATA%\Programs\SMN\) or by known STOCKSTAY malicious components. This behavior is associated with the STOCKSTAY 'Get' command, which gathers files and archives them in-memory for base64-encoded exfiltration.
Detects the execution of known Turla STOCKSTAY/STOCKTRADER backdoor components (ConverterDDSNet.exe or SMEditor.exe) which are used to perform unauthorized screen capture and data exfiltration from the victim's host.
Detects the STOCKSTAY/STOCKTRADER backdoor performing system discovery via WMI queries (Win32_OperatingSystem, Win32_Processor, or Win32_ComputerSystem). The detection identifies suspicious WMI activity originating from or associated with processes named after known Turla StockMarket components.
Page 1 of 4