Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
85 detections
Filters
Last updated
All Time
Detection languages
43
24
11
4
2
Contributors
16
14
11
9
9
Categories
40
18
17
17
15
Platforms
73
25
18
5
1
Products / Services
17
16
8
8
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
IDS Classtypes
3
1
IDS Protocols
4
KQL Query
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity
Lazarus Loaders
Sigma
Detects different loaders as described in various threat reports on Lazarus group activity
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects different process creation events as described in Malwarebytes's threat report on Lazarus group activity
Lazarus Loaders
Sigma
Detects different loaders as described in various threat reports on Lazarus group activity
This rule detects process creation events where the command line contains a specific, unique string ' uTYNkfKxHiZrx3KJ'. This string is identified as an indicator of compromise associated with the Diamond Sleet APT group, also known as Lazarus Group. The rule aims to identify execution of malicious payloads or commands used by this threat actor.
This rule detects DNS queries to specific domains identified as indicators of compromise (IOCs) associated with the Diamond Sleet APT group. The domains '3dkit.org', 'dersmarketim.com', 'galerielamy.com', and 'olidhealth.com' are known to be used by this threat actor for command and control (C2) communications. Monitoring for these specific DNS queries can help identify systems potentially compromised by Diamond Sleet.
Detects the creation of a scheduled task in the Windows Registry that is specifically associated with the Diamond Sleet APT group. This activity is linked to their exploitation of the TeamCity CVE-2023-42793 vulnerability, where they create a scheduled task named 'Windows TeamCity Settings User Interface' to establish persistence or execute malicious code.
Detects the creation of specific files in the ProgramData directory, which are known indicators of compromise associated with the Diamond Sleet APT group. These files include executables, DLLs, and other data files used in their attack campaigns.
Detects the creation of a scheduled task named '\Windows TeamCity Settings User Interface' with a specific content string 'uTYNkfKxHiZrx3KJ'. This activity has been linked to the Diamond Sleet APT group exploiting the TeamCity CVE-2023-42793 vulnerability for execution, persistence, and privilege escalation.
Detects the execution of 'node.exe' with command-line arguments indicative of arbitrary code execution, specifically looking for evaluation flags ('-e', '--eval') combined with patterns suggesting a reverse shell (e.g., '.exec(', 'net.socket', '.connect', 'child_process'). This behavior has been observed in attacks leveraging vulnerabilities like Log4j.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
This rule detects instances where specific system binaries (msdtc.exe or gpsvc.exe) are executed from non-standard Windows system directories. This behavior is often indicative of masquerading, where malicious executables are named after legitimate system processes to evade detection, a tactic known to be used by the Lazarus Group.
Detects the creation of Virtual Hard Disk (.vhd or .vhdx) files by common browser processes. This activity can be indicative of malware delivery, as adversaries may use VHD files to encapsulate payloads and bypass security controls, particularly Mark-of-the-Web (MOTW) protections.
Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.
Page 4 of 5