Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
Platforms
2
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects attempts to modify system services or WMI settings, which are behaviors associated with the Blue Mockingbird cryptominer. Specifically, it looks for 'sc config' commands that include 'wercplsupporte.dll' and 'wmic.exe' commands ending with 'COR_PROFILER'. These command-line patterns indicate potential persistence or defense evasion mechanisms used by the threat.
This rule detects attempts to modify the 'ServiceDll' registry value for the 'wercplsupport' service. This specific modification is associated with the Blue Mockingbird cryptominer, which uses this technique for persistence by hijacking a legitimate service to load its malicious DLL.