Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
2
1
1
1
Platforms
3
Products / Services
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
GALLIUM IOCs
Sigma
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.
This rule detects the creation of processes with specific SHA1 or SHA256 hashes that have been identified as indicators of compromise (IOCs) associated with the GALLIUM cyber espionage group. These hashes correspond to known malicious executables used by the group. The detection is based on a report by Microsoft Threat Intelligence Center from December 2019, which detailed GALLIUM's targeting of global telecommunications.
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.