Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
52
30
30
28
15
Contributors
75
54
16
6
6
Categories
64
50
46
39
37
Platforms
130
33
5
4
2
Products / Services
59
41
30
30
18
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
24
6
IDS Protocols
26
4
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects WScript.exe performing multiple registry queries against sensitive Windows Classes and file association keys. This pattern of behavioral profiling is consistent with Kimsuky's NUKESPED downloader or JSE loader identifying system configuration before payload execution.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
This rule detects command-and-control (C2) communication patterns associated with the Kimsuky threat group (specifically NUKESPED malware). It identifies network traffic to specific Fastly CDN IP addresses or domains related to the National Health Insurance Service (nhis.or.kr) originating from known malicious or suspicious execution processes like wscript.exe, cscript.exe, powershell.exe, or zlrenu8.exe.
Detects instances where wscript.exe or cscript.exe (commonly used to execute JSE files) spawns powershell.exe with command-line arguments indicative of the Kimsuky NUKESPED malware loader. The detection specifically looks for the combination of hidden window, base64 decoding flags, and execution from or manipulation of paths within C:\ProgramData.
Detects the NUKESPED backdoor component 'zlrenu8.exe' interacting with the 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows' registry key. This activity is consistent with malware performing environment profiling or establishing persistence by targeting registry keys used for automatic startup.
Detects the execution of JScript Encoded (.jse) files via wscript.exe or cscript.exe when spawned by Office applications or email clients. This pattern is indicative of Kimsuky initial stage payloads, where a malicious lure file is dropped into a user-writable directory (e.g., Temp, AppData, Downloads) and subsequently executed.
Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.
Detects the execution of short (6-10 characters), randomized alphanumeric executables located in typically writeable directories like ProgramData or Temp. The detection triggers when these files are spawned by common scripting engines (wscript.exe, cscript.exe, or powershell.exe), which is a characteristic behavioral pattern for the Kimsuky NUKESPED malware's secondary stage where a JSE dropper executes a renamed payload.
Detects instances where wscript.exe or cscript.exe spawn PowerShell with suspicious command-line arguments indicative of the Kimsuky NUKESPED campaign. This involves PowerShell commands using window-hidden styles, decoding flags, or referencing ProgramData/path-traversal patterns often used by Kimsuky to load malicious payloads.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
This rule detects activities associated with the Kimsuky NUKESPED malware loader, including the execution of malicious .jse scripts, PowerShell-based obfuscated payload decoding using 'ProgramData' as a staging path, and the subsequent execution of the 'zlrenu8.exe' payload. The rule specifically targets the multi-stage infection chain where scripts are used to perform anti-analysis and sandbox evasion before launching the primary malicious component.
Detects the NUKESPED (zlrenu8.exe) implant performing post-compromise reconnaissance. This rule monitors for registry enumeration and modification, as well as the spawning of common system discovery processes (e.g., net.exe, tasklist.exe, systeminfo.exe) and the querying of specific registry keys related to OS version and computer identification.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
This rule detects suspicious outbound network connections to specific Fastly CDN IP addresses associated with the Kimsuky threat group's NUKESPED backdoor. The rule identifies processes attempting to communicate with these infrastructure IPs that are not part of a predefined list of trusted or common legitimate applications, indicating potential command and control (C2) activity.
Detects malicious activity associated with the Kimsuky NUKESPED campaign, specifically the execution of .jse droppers from the Downloads directory using Windows Script Host (wscript.exe/cscript.exe), execution of known malicious files by SHA256 hash, and the presence or creation of the associated zlrenu8.exe payload.
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Page 7 of 9