Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
52
30
30
28
15
Contributors
75
54
16
6
6
Categories
64
50
46
39
37
Platforms
130
33
5
4
2
Products / Services
59
41
30
30
18
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
24
6
IDS Protocols
26
4
Detects evidence of file deletion activity associated with the Kimsuky NUKESPED loader chain. The rule monitors for the execution of 'del' commands via cmd.exe initiated by script interpreters (wscript.exe, powershell.exe) to remove malicious artifacts such as .jse, .a9oc files, or specific executable names like zlrenu8.exe from the system, characteristic of post-exploitation cleanup.
Detects host profiling activities performed by Kimsuky malware loaders, specifically the use of WMI queries for process enumeration or the execution of 'tasklist' commands. The rule identifies markers often found in the output of these enumeration scripts to identify potential pre-payload reconnaissance.
Detects the deletion of a .jse file from the user's Downloads directory by Windows Script Host (wscript.exe or cscript.exe). This behavior is consistent with the NUKESPED loader's anti-forensic cleanup routine, where the initial dropper deletes itself after staging subsequent payloads in secondary locations like ProgramData.
Detects the execution of the NUKESPED backdoor component 'zlrenu8.exe', which is associated with Kimsuky threat actor activity. This component is known to function as a keystroke logger using SetWindowsHookEx to capture user input.
Detects the NUKESPED backdoor (zlrenu8.exe) performing post-compromise system information discovery. The rule monitors for registry key enumeration within HKLM/HKCU SOFTWARE hives and the execution of the systeminfo.exe utility.
Detects instances where a process, other than standard browsers or common system applications, loads 'WINHTTP.dll' and subsequently initiates outbound HTTPS connections. This behavior is often indicative of custom malware or specialized tooling, such as the NUKESPED/Kimsuky framework, using direct API calls for command and control (C2) communication to bypass standard application-based network filtering.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects a suspicious file deletion event where a JSE script is deleted from the Downloads directory by wscript.exe or cscript.exe. This activity is indicative of the Kimsuky threat group's NUKESPED dropper cleaning up its own artifact after execution to avoid forensic detection.
Detects the execution of PowerShell via WScript or CScript (WshShell.Run) with hidden window flags, involving the use of 'certutil' to decode a staged payload located in a ProgramData directory. This pattern is characteristic of Kimsuky loader activity.
Detects the Kimsuky threat group using a JSE-based loader to write decoded binary payloads to the C:\ProgramData directory. The files are written using randomized filenames with specific non-standard extensions (.a9oc, .lpXD, .lpxQ, .lpXO) initiated by wscript.exe or cscript.exe, a technique observed in their January 2026 campaign.
Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
Detects the execution of the NUKESPED backdoor (specifically the file named zlrenu8.exe), which is associated with Kimsuky's espionage operations, including screen capture activities.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.
Detects host reconnaissance activity where the zlrenu8.exe process (associated with the NUKESPED backdoor/Kimsuky threat group) attempts to enumerate sensitive registry keys under HKLM\SOFTWARE and HKLM\SYSTEM. This behavior is indicative of post-exploitation discovery activities.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
Detects the abuse of the Windows built-in Certutil.exe utility for deobfuscating files or downloading remote content. This rule identifies common patterns associated with malicious activity, including the decoding of encoded files and the use of the urlcache flag to download remote files, which are techniques often used to bypass security controls and retrieve second-stage payloads.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Page 6 of 9