Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
