Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
1
1
1
1
Categories
3
1
1
1
1
Platforms
3
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects the execution of script files with .js or .se extensions using wscript.exe or cscript.exe outside of standard system directories. This behavior is consistent with the More_eggs JScript backdoor, which has been utilized by the FIN6 threat group (also known as Skeleton Spider) to establish persistent backdoors for follow-on payload delivery.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects suspicious execution of JavaScript via WScript or CScript, often indicative of initial access malware delivery by Skeleton Spider (FIN6) using .LNK files. This aligns with the "More_eggs Malware Delivery Chain" where .LNK files execute hidden JavaScript using wscript.exe.
The following analytic identifies the execution of `adfind.exe` with specific command-line arguments related to Active Directory queries. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant because `adfind.exe` is a powerful tool often used by threat actors like Wizard Spider and FIN6 to gather sensitive AD information. If confirmed malicious, this activity could allow attackers to map the AD environment, facilitating further attacks such as privilege escalation or lateral movement.
