Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
2
1
1
Contributors
5
2
1
1
Categories
4
2
2
2
1
Platforms
9
Products / Services
4
2
2
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects the execution of nested, hidden, and bypassed PowerShell sessions spawned by cmd.exe, typically launched from a Startup LNK file. This behavior is associated with the SHADOW-EARTH-066 campaign, which uses specific command-line arguments for evasion and loads payloads from C:\ProgramData\ using Invoke-Expression or iex.
Detects the creation or modification of a specific scheduled task containing the string "M1onltor". This is an artifact of SHADOW-EARTH-053 establishing continuous persistence for their side-loaded malware loaders.
Detects the explicit loading of the Exchange Management snap-in by PowerShell, often a precursor to mailbox exfiltration as seen in SHADOW-EARTH-053 activity. This activity can indicate an adversary is preparing to interact with Exchange mailboxes.
Identifies the creation of specific web shell filenames associated with SHADOW-EARTH-053 within targeted IIS and Exchange Web application directories. This rule detects the creation of known web shell files in critical web server paths, indicating an adversary's attempt to establish persistent access and remote control over the compromised server.
Monitors for modifications to the LocalAccountTokenFilterPolicy registry key being set to 1, a technique used by the IOX proxy (and SHADOW-EARTH-053) to enable Pass-the-Hash attacks and grant administrative rights to remote connections.
Suspicious IIS Worker Child Process
Cortex XDR
Detects the IIS worker process (w3wp.exe) spawning anomalous or administrative child processes (e.g., rundll32.exe, csvde.exe, nltest.exe), indicative of post-exploitation web shell activity associated with SHADOW-EARTH-053.
Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.
The analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.