Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
31
2
2
1
Contributors
25
12
10
9
4
Categories
37
30
16
8
6
Platforms
62
10
4
2
2
Products / Services
24
12
6
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects the execution of a shortcut file named 'MicrosoftUpdateSerice.lnk', which is a common misspelling of 'MicrosoftUpdateService.lnk'. This technique is often used for evasive startup persistence by adversaries, as highlighted by its use in APT28/MuddyWater campaigns.
Detects node.exe spawning cmd.exe. In Seedworm intrusions, Node.js acts as an anomalous loader to orchestrate subsequent commands instead of a human operator.
Detects scripts or commands that directly reference 'RtlDosPathNameToNtPathName' in their command line. This function can be used by adversaries for NT path evasion, a technique to manipulate how the operating system resolves file paths, potentially leading to execution of malicious files or bypassing security controls. The detection is based on the presence of this specific function name in process command lines.
Detects Node.js executing the Fortemedia audio utility fmapp.exe, indicative of a staged DLL sideloading attack orchestrated by a script.
Detects 'gp_v7_reflective.py', a Python reflective loader for GodPotato evasion, associated with the MuddyWater threat group.
Detects the execution of the 'wmi_remote_escalate.py' script, which is associated with the MuddyWater APT group for lateral movement and privilege escalation using Windows Management Instrumentation (WMI).
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects deceptive registration using the exact string 'Microsoft Update Service' mapped to non-Microsoft binaries in non-standard paths. This could indicate an adversary attempting to masquerade malicious activity as legitimate system services.
Detects the execution of 'reset.ps1' via PowerShell, which has been identified as the ChainShell deployer script. This activity is associated with the MuddyWater threat group.
Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects C2 communication from Boggy Serpens (MuddyWater) backdoors like Nuso and BlackBeard, which use non-standard HTTP status codes (201, 202, 418) to receive commands from known C2 servers.
Detects potential data exfiltration by the BlackBeard backdoor, associated with Boggy Serpens (MuddyWater). The malware abuses the HTTP 'Expires' header in client requests to exfiltrate encrypted system data to its command and control server. The 'Expires' header is a standard response header, so its presence in a request is highly anomalous.
Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.
Detects potential DLL side-loading activity associated with the MuddyWater threat actor. The rule identifies the legitimate Fortemedia application, FMAPP.exe, initiating network connections while running from a non-standard or suspicious directory, such as C:\Users\Public\Downloads\. This behavior is indicative of a malicious FMAPP.dll being loaded for command-and-control (C2) communications.
Detects the execution of `deno.exe`, the Deno runtime for JavaScript and TypeScript. This was observed being leveraged by the Iranian APT group Seedworm (aka MuddyWater) to execute a new backdoor named Dindoor.
Detects files signed with a code-signing certificate issued to 'Amy Cherne'. This certificate was observed being used by the Iranian APT group Seedworm (aka MuddyWater) to sign new backdoors named Dindoor and Fakeset.
Detects the use of Rclone to exfiltrate data to a Wasabi cloud storage bucket. This technique was observed being used by the Iranian APT group Seedworm.
Page 2 of 4