Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
52
30
30
28
15
Contributors
75
54
16
6
6
Categories
64
50
46
39
37
Platforms
130
33
5
4
2
Products / Services
59
41
30
30
18
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
24
6
IDS Protocols
26
4
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps email telemetry for exact matches against known Kimsuky (APT-C-55) infrastructure email addresses. Matches are exact and case-insensitive. MatchType separates inbound mail from the actor and outbound mail to the actor.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
Detects incoming HTTP GET requests containing a specific URI path '/favorite_list_2x_m500_ico.jpg' associated with the Ted Backdoor, commonly used by North Korean state-sponsored threat actors including APT37, Lazarus Group, and Kimsuky for Command and Control (C2) beaconing.
Detects outbound HTTP GET requests to Pastebin.com with a path starting with /raw/. This pattern is commonly used by threat actors, including the Kimsuky APT group, to retrieve secondary payloads, configuration files, or malicious scripts from a public repository.
Detects anomalous HTTP traffic patterns identified in the 'Ted' backdoor used by North Korean-affiliated threat actors (APT37/Kimsuky/Lazarus). The rule specifically monitors the 'Accept-Language' HTTP header for a specific construction containing 'mrt=' followed by 'msc=' or 'mst=', which is used as a covert mechanism for authentication or command signaling.
Detects HTTP GET requests to raw.githubusercontent.com that include an 'Authorization: token' header, indicating the potential use of a GitHub Personal Access Token (PAT) for command and control or data exfiltration by the Kimsuky threat group.
Page 1 of 9