Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
31
2
2
1
Contributors
25
12
10
9
4
Categories
37
30
16
8
6
Platforms
62
10
4
2
2
Products / Services
24
12
6
5
5
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects network traffic to known command and control (C2) domains used by the Iranian APT group Seedworm to distribute the Fakeset backdoor. These domains are hosted on the Backblaze cloud storage service.
Detects known malware hashes associated with the Iranian APT group Seedworm (aka MuddyWater), including their Dindoor, Fakeset, Stagecomp, and Darkcomp malware families.
Detects Microsoft Office applications such as Word or Excel spawning a command-line interpreter (cmd.exe or powershell.exe). This behavior is often associated with malicious documents that execute macros to run commands on the victim's system. The MuddyWater group has been observed using this technique in their 'Operation Olalampo' campaign.
This rule detects suspicious process creation patterns indicative of the MuddyWater (also known as RustyWater) APT group. Specifically, it looks for Microsoft Office applications (Word, Excel, PowerPoint) launching scripting or Living Off The Land Binaries (LOLBins) such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. The detection is further narrowed down by checking if these processes are created in suspicious writable paths like ProgramData, Users\Public, AppData\Roaming, or AppData\Local\Temp. Additionally, the rule includes optional enrichment for known MuddyWater/RustyWater payload names (reddit.exe, art.exe, cloud.exe, nginx.exe), persistence via the Run registry key, and the dropping of a specific staging artifact named 'CertificationKit.ini'.
Detects the execution of the RustyWater implant payload "CertificationKit.ini" from the "C:\ProgramData" directory. This activity is associated with the MuddyWater APT group.
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Detects the unique User-Agent string "A WinHTTP Example Program/1.0" used by the MuddyViper backdoor for C2 communications, as reported in the MuddyWater campaign.
Detects the use of the AADInternals PowerShell module, a tool used by threat actors like MERCURY and DEV-1084 for credential theft and privilege escalation in Azure AD environments.
KQL Query
Detects various indicators of Microsoft Connection Manager Profile Installer execution
MERCURY APT Activity
Sigma
Detects suspicious command line patterns seen being used by MERCURY APT
'Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Detects potential Muddywater APT activity
MERCURY APT Activity
Sigma
Detects suspicious command line patterns seen being used by MERCURY APT
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Page 3 of 4