Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
31
2
2
1
Contributors
25
12
10
9
4
Categories
37
30
16
8
6
Platforms
62
10
4
2
2
Products / Services
24
12
6
5
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects the silent installation of common Remote Monitoring and Management (RMM) tools (ScreenConnect, Atera, AnyDesk) when triggered by potentially suspicious parent processes such as email clients, web browsers, or archive utilities. This pattern is characteristic of MuddyWater's (Mango Sandstorm) post-compromise tradecraft for establishing persistent C2 channels.
This rule performs a comprehensive hunt for activities associated with the MuddyWater (also known as Boggy Serpens) threat group, specifically relating to their 'Operation Olalampo' campaign. It monitors for spearphishing artifacts (lure documents and attachments), execution of specific malware and drop artifacts, the use of LOLBins by Office applications, unauthorized remote access via AnyDesk, Telegram-based C2 communication, and persistence mechanisms such as registry run keys and specific file extensions (.wdlp).
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects references to the ChainShell installer script 'VfZUSQi6oerKau.js' within process command lines. This script is associated with the MuddyWater threat group.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects node.exe spawning PowerShell, a technique used by the MuddyWater (also known as Seedworm) threat group for post-exploitation reconnaissance, staging, and screenshot capture. This rule specifically looks for the 'node.exe' process initiating 'powershell.exe' or 'pwsh.exe'.
Detects the execution or presence of a script named 'proxyshell_01.sh' in process command lines. This script has been associated with MuddyWater activity, specifically in the context of exploiting ProxyShell vulnerabilities.
Detects Node.js orchestrating the SentinelOne memory scanner for evasion and targeted DLL sideloading. This behavior is indicative of an adversary attempting to use legitimate tools in an unexpected way, potentially to bypass security controls or perform malicious actions under the guise of a trusted process.
Detects the execution of the 'sqlagent_escalate.py' tool, which is known to be used by the MuddyWater threat group for SQL escalation. This rule specifically looks for the presence of 'sqlagent_escalate.py' in process command lines.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Detects the execution of 'tango13.ps1', a PowerShell payload associated with the Iranian APT group MuddyWater (also known as Seedworm or APT33), which has been observed being dropped via Microsoft Teams.
Identifies execution of 'c2_fixed.py' or 'c2_fixed_v2.py' used in MuddyWater C2 operations. These scripts are associated with the MuddyWater threat group for command and control activities.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Identifies fmapp.exe running from user-writable paths (AppData, Temp) to sideload the malicious fmapp.dll payload.
Detects deno.exe executing encoded base64 blobs via the '-e' parameter. This activity is associated with the MuddyWater APT group.
Detects deno.exe executing inline scripts via 'eval', indicating DINODANCE/Tsundere malware execution. This behavior is associated with the MuddyWater APT group.
Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.
Detects scripts combining AllocConsole and ConsoleWindowClass to explicitly hide application windows. This technique can be used by adversaries to conceal their malicious activity.
Detects the execution of 'sysuu2etiprun.js', which is identified as the ChainShell blockchain C2 agent. This activity indicates potential command and control communication using a blockchain-based mechanism.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.
Page 1 of 4