Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
9
3
1
1
Contributors
7
2
2
1
1
Categories
8
5
4
4
3
Platforms
14
4
4
Products / Services
6
3
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
Detects the creation of a local user account followed by the modification of the Winlogon SpecialAccounts\UserList registry key to hide the account from the Windows logon UI. This behavior is indicative of persistent access maintenance by adversaries, such as the Andariel threat group.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects PowerShell execution initiated by 'MicrosoftSystem64.exe' or 'MicrosoftSystem64' with specific command-line arguments (-NoProfile, -NonInteractive, -Command). This activity is indicative of the Node.js SEA RAT malware, associated with the DPRK-linked actor FAMOUS CHOLLIMA, attempting remote command execution.
Detects the execution of the 'MicrosoftSystem64' RAT binary across Windows, macOS, and Linux operating systems. This specific malware is associated with the FAMOUS CHOLLIMA threat group, which is linked to DPRK, and is known to deploy a Node.js SEA RAT that exfiltrates data to HuggingFace.
This rule detects the creation of a scheduled task named 'MicrosoftSystem64' using various methods. It looks for command-line execution of 'schtasks.exe /create' with the specific task name, explicit ScheduledTaskCreated events from Microsoft Defender for Endpoint (MDE) containing 'MicrosoftSystem64', and Windows Security Event ID 4698 (Scheduled Task Created) where the TaskName contains 'MicrosoftSystem64'. This specific task name is associated with known threat actor activity, particularly FAMOUS CHOLLIMA / DPRK-linked actors deploying Node.js SEA RAT.
Detects the creation of hidden local accounts using the 'net user' command where the username ends with a '$' symbol. This technique is used by the Andariel group for RID hijacking attacks to maintain stealthy persistence.
Detects the creation of hidden local accounts using the 'net user' command where the username ends with a '$' symbol. This technique is used by the Andariel group for RID hijacking attacks to maintain stealthy persistence.
Detects the installation of malicious npm packages, such as 'node-nvm-ssh', used by the Famous Chollima group. The detection focuses on suspicious post-install scripts executed by node.exe, which is a known TTP for this actor to deliver malware like BeaverTail and OtterCookie.
This rule identifies emails originating from sender addresses listed in a GitHub-hosted CSV file, which is explicitly named 'North-Korean-Emails'. The rule's purpose is to flag incoming emails that appear to be sent from individuals or entities associated with North Korea, based on the provided list of email addresses. This could indicate potential phishing, espionage, or other malicious activities originating from North Korean threat actors.
Detects the creation of a specific file, 'inetmgr.exe', in the 'C:\Windows\ADFS\bg\' directory. This activity has been linked to the Onyx Sleet (also known as Andariel) APT group, particularly in the context of exploiting the TeamCity CVE-2023-42793 vulnerability.
