Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
11
2
Contributors
6
4
2
1
Categories
7
3
2
2
2
Platforms
9
2
2
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Detects specific process creation patterns associated with the Winnti malware campaign targeting Hong Kong universities in late 2019 and early 2020. The rule looks for suspicious parent-child process relationships and specific file paths used by the malware, such as executables under 'C:\Windows\Temp', 'C:\ProgramData\DRM', and 'C:\ProgramData\DRM\CLR'. It also identifies instances where legitimate applications like 'wmplayer.exe' or 'SearchFilterHost.exe' are launched from these suspicious directories or by suspicious parent processes.
Detects specific command-line characteristics associated with the Winnti Pipemon malware, as reported by ESET. The rule looks for `setup0.exe -p` or `setup.exe` with command-line arguments ending in `-x:0`, `-x:1`, or `-x:2`.
Detects modifications to the 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data' registry key, which is associated with the RedMimicry Winnti playbook. This registry key can be used for persistence or defense evasion by adversaries.
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects specific process characteristics of Winnti Pipemon malware reported by ESET
Detects specific process characteristics of Winnti Pipemon malware reported by ESET
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
Detects specific filenames associated with Winnti dropper activity, as detailed in the RedMimicry Winnti playbook. The rule looks for the creation or modification of 'gthread-3.6.dll', 'sigcmm-2.4.dll', or 'Windows\Temp\tmp.bat', which are known indicators of compromise for Winnti malware.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.