Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
2
2
1
Categories
4
1
Platforms
5
Products / Services
1
1
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
Detects the execution of DLL side-loading malware used by the threat group Emissary Panda, also known as APT27. Specifically, it looks for `svchost.exe` being spawned by `sllauncher.exe` or `svchost.exe` being spawned from a user's `AppData\Roaming` directory with the `-k` command-line argument, which are indicators of this specific malware's behavior.
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Search for the CVEs that should be prioritized and resolved to reduce the success of the FireEye Red Team tools compromised by the Nobelium activity group.
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
This rule detects attempts to disable HTTP logging on a Windows Internet Information Services (IIS) web server using the 'appcmd.exe' utility. Specifically, it looks for command-line arguments that set the 'httplogging' section with 'dontLog:true'. This activity is associated with defense evasion tactics, as observed by threat groups like Threat Group-3390 (Bronze Union), to remove forensic evidence of their activities.