Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
64 detections
Filters
Last updated
All Time
Detection languages
23
15
12
6
5
Contributors
15
13
8
5
5
Categories
31
23
17
8
6
Platforms
59
5
5
5
Products / Services
26
23
16
12
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
4
1
IDS Protocols
5
Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
Detects incoming HTTP GET requests containing a specific URI path '/favorite_list_2x_m500_ico.jpg' associated with the Ted Backdoor, commonly used by North Korean state-sponsored threat actors including APT37, Lazarus Group, and Kimsuky for Command and Control (C2) beaconing.
Detects anomalous HTTP traffic patterns identified in the 'Ted' backdoor used by North Korean-affiliated threat actors (APT37/Kimsuky/Lazarus). The rule specifically monitors the 'Accept-Language' HTTP header for a specific construction containing 'mrt=' followed by 'msc=' or 'mst=', which is used as a covert mechanism for authentication or command signaling.
Detects execution of cmd.exe with suspicious command-line patterns utilizing environment variable substring expansion (%VAR:~offset,length%). This technique is used to dynamically reconstruct and execute obfuscated commands, a method historically observed in APT37 delivery chains to hide malicious payloads and bypass simple string-based signatures.
Detects outbound HTTP POST requests to a specific URL pattern (/board/fckeditor/userfiles/editor/board.php) associated with the Chinotto backdoor used by the APT37 threat group. The rule monitors for a specific Chrome user agent and a 'token=' cookie value, indicating a potential C2 check-in.
Detects the download and subsequent extraction of the Python embeddable zip package to directories under 'C:\Users\Public'. This activity is consistent with techniques used by threat actors, such as APT37, to establish a covert Python runtime environment on a compromised host for further malicious operations.
Detects outbound HTTP POST requests directed to 'kmot.co/board.php', which is associated with Command and Control (C2) activity from the Chinotto Python-based backdoor attributed to APT37.
Detects the execution of Python interpreters from non-standard, user-writable directories (such as Public\Music) or using suspicious filenames. This behavior is indicative of threat actors abusing the Python Embeddable package to run disguised Python backdoors, such as the Chinotto malware family observed in APT37 operations, often staged via batch scripts or curl.
Detects the creation or execution of a scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the invocation of specific associated file names 'codeflush.exe' or 'settingenv.cat', which are indicators of persistence used by the threat actor APT37.
Detects malicious file system activity where the legitimate Python interpreter (python.exe) is deleted and replaced or renamed to a deceptive filename (codeflush.exe) within the 'C:\Users\Public\Music\MusicLibrariesPackage' directory. This technique is used by threat actors, including APT37, to mask the execution of Python-based backdoors and evade detection.
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects the creation of scheduled tasks at 1-minute intervals using 'schtasks.exe' that employ masqueraded names (e.g., MicrosoftUserInterface) or execute known suspicious payloads associated with the NarwhalRAT malware (e.g., python scripts or .cat files). This behavior is characteristic of persistence mechanisms used by APT37.
Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
Detects a suspicious command line execution from explorer.exe involving syswow64\cmd.exe with specific variable substitution obfuscation patterns often associated with APT37's LNK-based NarwhalRAT delivery. The rule correlates this command execution with the subsequent launch of Python or userscreen.exe within a 5-minute window, a pattern indicative of second-stage payload delivery.
Detects suspected NarwhalRAT activity where a process (e.g., userscreen.exe or pythonw.exe in suspicious locations) communicates with the pCloud API to resolve a dead-drop location, followed within 60 seconds by a beacon connection to a different remote IP, characteristic of C2 communication.
Detects the creation of scheduled tasks with suspicious task names (e.g., masquerading as Microsoft UI components) or payloads (e.g., Python interpreters or .cat files) set to execute every minute. This behavior is associated with the persistence mechanism of the NarwhalRAT malware used by the APT37 threat group.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Detects a game-related child process collecting username, language, timezone, keyboard layout, and regional settings in one sequence. This rule specifically looks for command-line executions using 'cmd.exe', 'powershell.exe', or 'wmic.exe' that include commands like 'whoami', 'Get-WinSystemLocale', 'Get-TimeZone', 'Get-WinUserLanguageList', 'keyboard layout', or 'Win32_TimeZone'.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Page 1 of 4