Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
Products / Services
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects PowerShell commands using `curl -o` to download `.dll`, `.pyc`, or other suspicious file extensions to temporary user directories. This technique was observed being used by the Confucius group to download their malware components.
Detects potential DLL side-loading activity associated with the Confucius threat group. This rule identifies when a legitimate executable, known to be abused by Confucius (e.g., fixmapi.exe), is run from a non-standard, user-writable directory and loads a suspicious DLL from the same location.
