Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
2
1
1
1
Categories
3
2
1
1
1
Platforms
4
1
Products / Services
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects network activity associated with the LONGTALE malware family (attributed to APT31/JungleBamboo). This includes identification of specific malicious browser extension IDs in HTTP traffic and signature-based detection of periodic HTTPS/HTTP beaconing patterns indicative of session or cookie exfiltration.
Detects activity associated with the APT31 (ZIRCONIUM) threat group, specifically focusing on credential dumping using ldifde, lateral movement attempts involving copying tools like procdump64.exe, netsess.exe, and 7za.exe to remote shares, and archiving data. This rule is based on observations described in the Crowdstrike 2019 Global Threat Report.
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report