Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
8
3
3
2
2
Contributors
13
4
1
1
Categories
6
4
3
3
3
Platforms
13
4
2
2
1
Products / Services
8
4
3
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detects registry modifications consistent with Blind Eagle's Hidden RDP (HRDP) module, which disables Network Level Authentication (NLA) on the RDP listener and hides a local admin account from the Windows login screen via the SpecialAccounts\UserList registry key, as part of enabling covert RDP access reverse-tunneled to a C2 server.
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects Blind Eagle JC-46 VBScript/JScript loader obfuscation toolmarks: zv-prefixed self-mutating XOR decryptor with 0xE0 key, junk arithmetic index shuffle, custom RC4-like stream decoder, custom AES S-box/RCON with 0xA5 mask, Wales() decimal decoder, Base28 alphabet, and oversized VBScript droppers
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects Blind Eagle JC-46 toolkit static artifacts: leftover XLoader/FormBook builder tag and variable name in decrypted PowerShell orchestrator stages, leaked CryptoObfuscator PDB path in the Paralell.dll injector, forged NVIDIA version-resource string, and Spanish-language HVNC/browser-clone distraction overlay text in the AsyncRAT payload
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
Detects inbound emails with a Virtual Hard Disk (VHDX) file attachment. This technique has been used by APT-C-60 to deliver the SpyGlace backdoor, often disguised as a job application.
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: Detecting M365 Copilot Shared Agent
KQL Query from file: CloudApp Suspicious Copilot Agent Detection
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)