Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
3
2
1
1
1
Contributors
5
2
1
Categories
4
4
3
1
1
Platforms
7
2
1
1
Products / Services
4
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
Detects the loader-pool.db PNG-format file used to smuggle encrypted payload modules inside IDAT chunks, reassembled after a sleep-based evasion delay
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects uncommon or suspicious child processes spawning from a VsCode process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
KQL Query from file: APT Stealth Falcon - CVE-2025-33053 Detection
