Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
4
3
2
2
Contributors
5
3
1
1
1
Categories
5
3
2
2
2
Platforms
10
1
1
1
Products / Services
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Identifies a signed binary associated with Fox Tempest loading an unsigned, anomalous DLL from the same directory, specifically from common user-writable directories like Downloads, Temp, or AppData. This behavior is indicative of DLL side-loading for defense evasion or privilege escalation.
Detects the execution of Windows 365 native clients (Windows365.exe). Threat actors like UNC3753 abuse legitimate VDI clients on compromised BYOD devices to bypass corporate perimeters and access sensitive internal network segments.
Privnote DNS Resolution
Cortex XDR
Identifies endpoints resolving privnote.com, a self-destructing message service abused by UNC3753 to transmit malicious installation links while bypassing chat and email filtering.
Detects curl making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Windows 365 Client Execution
Cortex XDR
Monitors for the execution of Windows 365 native clients. UNC3753 abuses legitimate VDI clients on compromised personal devices to bypass initial corporate perimeters and access sensitive network segments.
Detects network connections to known Command and Control (C2) servers associated with the ValleyRAT backdoor, used by the Silver Fox APT group.
Detects an IIS worker process (w3wp.exe) spawning cmd.exe with a specific chain of reconnaissance commands (whoami, hostname, ipconfig). This behavior matches the default execution pattern of the 'hc2.aspx' and 'health_check_t.aspx' webshells observed in an Iranian-Nexus operation against Oman's government.
Detects persistence mechanism used by Valley RAT, associated with the Silver Fox APT. The malware stores its configuration or modular plugins as REG_BINARY data in the 'HKCU\Console' registry key.
Detects process hollowing of tracerpt.exe, a technique used by the Valley RAT malware (associated with Silver Fox APT) to execute downloaded plugins. The rule identifies the creation of tracerpt.exe in a suspended state, followed by the creation of a remote thread within it, which is a strong indicator of code injection.
Detects DLL side-loading activity associated with the Silver Fox APT, where the legitimate Thunder.exe application is executed from a temporary directory to load a malicious, unsigned libexpat.dll.
Detects the creation of Windows services used by the Silver Fox APT group to establish persistence for their loader and vulnerable driver. This activity is part of a campaign to deploy the ValleyRAT backdoor.
