Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
8
4
2
2
1
Contributors
6
4
2
2
1
Categories
10
7
7
3
3
Platforms
12
8
5
3
Products / Services
4
2
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
1
IDS Protocols
2
Detects Microsoft Office applications (Winword/Excel) spawning PowerShell or MSHTA with base64-encoded command-line arguments, followed by subsequent persistence mechanisms such as creating scheduled tasks or modifying Registry Run keys. This behavior is indicative of APT38 (BlueNoroff) and similar campaigns delivering banking Trojans via malicious Office macros.
Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.
Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.
Detects Mach-O ARM64 payloads disguised as legitimate macOS system utilities (CamDriverUpdate.app camera driver updater, Chrome.MediaPatcher) used in the BlueNoroff ClickFix campaign
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects PowerShell command lines utilizing Invoke-WebRequest (or aliases) with a spoofed "ZoomSDK" User-Agent for payload delivery. This behavior is associated with BlueNoroff ClickFix campaigns targeting the Web3 sector.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects network connections to a known Sapphire Sleet (APT38) command and control (C2) IP address and port, or DNS resolution requests for a malicious Sapphire Sleet C2 domain. This rule identifies direct communication with infrastructure associated with the Sapphire Sleet threat actor.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects the creation of a macOS Launch Agent by a suspicious process or with a name matching patterns used by the BlueNoroff group. BlueNoroff uses Launch Agents for persistence on compromised macOS systems.
This rule identifies emails originating from sender addresses listed in a GitHub-hosted CSV file, which is explicitly named 'North-Korean-Emails'. The rule's purpose is to flag incoming emails that appear to be sent from individuals or entities associated with North Korea, based on the provided list of email addresses. This could indicate potential phishing, espionage, or other malicious activities originating from North Korean threat actors.
