Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
