Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
52
30
30
28
15
Contributors
75
54
16
6
6
Categories
64
50
46
39
37
Platforms
130
33
5
4
2
Products / Services
59
41
30
30
18
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
24
6
IDS Protocols
26
4
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.
Detects the execution of the VSCode CLI (code.exe) with the 'tunnel' argument, particularly when executed from uncommon directories like ProgramData or Users\Public, or when automated via piped input. This technique is actively abused by Kimsuky to establish covert C2 channels that bypass traditional network detections.
Detects the creation of the 'CacheDB' service or specific 'Everything' registry run keys, which are persistence mechanisms utilized by the httpMalice backdoor (a Kimsuky PebbleDash variant).
Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.
Detects the installation and execution of DWAgent (dwagsvc.exe) from the C:\ProgramData directory, specifically looking for service installation and startup commands. Threat actors like Kimsuky are known to use legitimate RMM tools like DWAgent to maintain persistent remote access while blending in with normal administrative activities.
Detects the specific command execution wrapper used by the Rust-based HelloDoor malware (part of the Kimsuky PebbleDash cluster). The malware sets the code page to 65001 (UTF-8), suppresses output to nul, and chains the execution of a payload using cmd.exe.
Detects the execution of a batch file from the non-standard C:\Users\Public\Music\ directory via cmd.exe. This behavior is associated with the intermediate stage of Kimsuky campaigns where it is used to download further payloads.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Detects when a Visual Studio Code process spawns a shell that immediately downloads and executes a script using a tool like `curl` and pipes it to a runtime like `node`. This indicates the abuse of `tasks.json` for code execution, a technique used by DPRK-linked actors.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects behavioral patterns
Detects network communication patterns
Detects RAT command structure
Detects P2B Airdrop variant
Detects native decryption library
Detects Auction delivery app variant
Detects the Kimsuky TTP of using legitimate cloud services like GitHub and Google Drive to download and subsequently execute malicious payloads, often using interpreters like mshta.exe or rundll32.exe.
Detects the execution of the UnRAR utility with a password to extract an archive. This technique is used by threat actors like the Kimsuky group and XWorm RAT to deliver malicious payloads.
Page 8 of 9