Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
62 detections
Filters
Last updated
All Time
Detection languages
30
13
8
4
3
Contributors
13
12
11
5
5
Categories
33
22
13
9
8
Platforms
60
2
Products / Services
27
17
5
4
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
1
1
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the execution of shortcut (.lnk) files located on removable media (USB) that spawn common Windows binaries (powershell.exe, cmd.exe, mshta.exe) with hidden window flags. This behavior is indicative of initial access or lateral movement techniques used by Mustang Panda (Earth Preta) for USB-based malware propagation and DLL side-loading.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects instances where a digitally signed executable loads a DLL from a non-standard, user-writable directory (such as Downloads, Desktop, Temp, or AppData). This behavior is characteristic of DLL side-loading, an evasion technique used to execute malicious code by placing a rogue DLL in a location where a legitimate binary might search for its dependencies, often used by threat actors to persist or maintain covert execution.
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Detects CoolClient's elevated self-relaunch using the 'passuac' command-line parameter combined with RPC-based process creation and PPID spoofing to bypass UAC.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects SHARDLOADER/ZOHOMURK/MINIRECON related loader DLL via embedded mutex name, XOR key, staging file paths, and exported function used in Mustang Panda campaigns
Detects persistence mechanisms used by the Mustang Panda threat actor (specifically the SHARDLOADER/ZOHOMURK malware variants). The rule monitors for the creation or modification of Windows Run registry keys using specific, known malicious value names (e.g., 'MediumNetMonIt', 'MicrosoftEdgeUpdateBrokerTask') or pointing to suspicious file paths located in 'C:\ProgramData\IDM\logs\' or within the 'VaultCache' folder.
Detects host reconnaissance and file discovery activities indicative of the MINIRECON implant, a tool linked to Mustang Panda campaigns. The rule monitors for the execution of common system enumeration and file searching commands triggered by the 'pct12bmp.exe' process, or in unauthorized contexts.
Detects execution of processes by masqueraded lure executables associated with Mustang Panda campaign themes (e.g., India-Taiwan relations, hydropower projects) spawning known LOLBins like rundll32.exe, regsvr32.exe, or PowerShell, indicating potential side-loading or malicious loader activity.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.
Detects execution of the SharpADWS reconnaissance tool or suspicious outbound network connections to Active Directory Web Services (ADWS) port 9389. This activity is used by threat actors, such as Mustang Panda, to perform Active Directory reconnaissance by bypassing standard LDAP logging.
Detects potential DLL sideloading activities where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver components load dynamic link libraries (DLLs) from non-standard or user-writable directory paths (e.g., Temp, AppData, Downloads). This behavior is characteristic of delivery chains associated with threat actor Mustang Panda, specifically utilizing loaders like SHARDLOADER or MINIRECON.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
This rule detects potential DLL sideloading activity associated with the SHARDLOADER implant, commonly linked to the threat actor Mustang Panda. It monitors for suspicious executable names (e.g., Project Proposal.exe) loading malicious DLLs (SolidPDFCreator.dll, ctxmui.dll) or interacting with specific staging directories in ProgramData or User Public folders, typical of their TTPs targeting government and energy sectors.
Page 1 of 3