Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
3
2
1
1
1
Platforms
3
2
Products / Services
3
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
This rule detects the execution of a specific Chinese-named payload, '_計畫申請審查結果通知單.exe', which is associated with the Dragon Weave campaign and the AZUREVEIL attack flow. It also correlates this process execution with the presence of 'BrowserViewUtility.exe' as an initiating process file event, indicating a multi-stage infection.
Correlates execution of a .pdf.lnk shortcut spawning wscript to run the empty.vbs bridge, followed by a PowerShell process.
Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).
Detects the disabling of the 'execInstalledOnly' kernel setting on an ESXi host, a critical security control that prevents the execution of unsigned binaries. This is often followed by a host reboot to apply the change. This TTP is used by threat groups like UNC3944 to prepare the hypervisor for custom ransomware execution.