Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
12
9
6
4
3
Contributors
27
4
1
1
1
Categories
12
11
11
10
10
Platforms
19
14
2
1
1
Products / Services
12
12
8
6
4
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
7
5
IDS Protocols
6
3
2
1
Detects the 'HCENC1:' marker in HTTP request and response bodies, which is associated with RUSTYSHADE malware used by the APT36 (Transparent Tribe) threat group for Command and Control communications.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects network activity associated with the APT36 threat group, specifically HTTP requests for PowerShell stagers (irm/iex) from 'indiatodays.org' and TLS connections to that same domain, which is identified as a typosquat used for command and control or ingress tool transfer.
Detects outbound HTTP requests to api.github.com targeting the 'contents' API with patterns indicative of RUSTYSHADE malware command-and-control (C2) communication, including file extensions and filenames typical of its tasking mechanisms.
Detects the execution of the RUSTYSHADE Rust-based backdoor, observed during Operation RapidRust, associated with the threat group APT36 (Transparent Tribe). The rule monitors for the specific 'DriverInstaller.exe' filename, known malicious file hashes, and suspicious command-line patterns involving PowerShell-based downloads of 'DriverInstaller.zip' from Backblaze cloud storage.
Detects network discovery activities including ICMP sweeps, ARP cache checks, and SMB share/session enumeration, which are common tactics used for internal reconnaissance by the threat group APT36 (Transparent Tribe).
Detects instances where Windows Explorer spawns cmd.exe to execute specific batch files (doxc.bat or config.bat), a behavior often associated with Transparent Tribe (APT36) activity involving malicious LNK shortcuts.
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the creation of files within the 'SystemFolder32' or 'System Folder32' directory under the user's Local AppData path, a known behavioral pattern for payload staging used by the Transparent Tribe threat actor.
Detects the creation of scheduled tasks using schtasks.exe or PowerShell that masquerade as legitimate Microsoft Edge or OneDrive update tasks. This behavior is associated with APT36 (Transparent Tribe) and their use of modular malware to establish persistence.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
Detects host-based network reconnaissance behaviors commonly associated with the threat group APT36 (Transparent Tribe). The rule identifies the execution of various built-in Windows network discovery commands including arp, nbtstat, net view/share/session, and automated ping sweeps or PowerShell-based subnet enumeration scripts, which are used to map reachable hosts and network shares.
Detects network communication with infrastructure associated with the Transparent Tribe threat group (APT36), including C2 traffic to a known malicious IP and DNS resolution for the sharema128.net domain, which are indicative of CrimsonRAT or Doxc malware activity.
Detects periodic beaconing and C2 communication patterns associated with the RapidRust Golang RAT, attributed to the APT36 (Transparent Tribe) threat group. The rule monitors for specific DNS queries to typosquatted domains, TLS SNI mismatches, and specific HTTP API polling activities commonly used by this malware for C2 tasking.
Detects outbound network traffic to the GitHub API, a known communication channel for the RUSTYSHADE malware and APT36 (Transparent Tribe) threat group, occurring outside of a previously observed operational cadence (weekdays 04:00-11:00 UTC). Deviations from this baseline pattern on weekends or off-hours suggest unauthorized C2 activity or changes in actor infrastructure.
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
Detects network beaconing activity associated with Transparent Tribe (APT36) Golang-based remote access trojans (RAT). The rule identifies specific HTTP POST requests to suspicious domains and URI paths ('/api/gym-facility', '/api/gym-membership') that mimic legitimate fitness-related traffic to blend in with environment noise.
Detects DNS queries and HTTP GET requests directed at known typosquatted domains associated with the APT36 (Transparent Tribe) threat group, which are utilized for payload staging and delivery.
Detects the execution of LNK files that launch cmd.exe to execute batch script files (e.g., .bat). This pattern is frequently used in malicious infection chains, such as those leveraged by Transparent Tribe (APT36), where ISO or ZIP archives contain LNK files masquerading as document files to trick users into executing malicious scripts.
Page 1 of 2