Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
16
6
3
2
1
Contributors
17
3
3
2
2
Categories
18
10
7
6
6
Platforms
16
11
5
2
Products / Services
16
2
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
16
IDS Protocols
7
7
2
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
Hunts for the specific UNC5142 EtherHiding/CLEARSHORT JavaScript patterns and BSC contract addresses published in the referenced report. This is a high-fidelity content match that is intended for scanning suspicious HTML/JS blobs recovered from compromised web content, web proxies that store bodies, or forensic collections.
Detects potential DLL Search Order Hijacking activity where a DLL is created in a legitimate software directory, followed by a process execution from that same directory. This pattern is consistent with UNC1549's technique of dropping malicious DLLs to be loaded by trusted applications.
This rule detects Command and Control (C2) beaconing activity associated with the UNC1549 threat group and the LIGHTRAIL malware. It specifically looks for HTTP traffic with a URI containing '/news', an 'Upgrade: websocket' header, and a distinct User-Agent string 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136'. This combination of indicators suggests an attempt to tunnel C2 communications over HTTP, potentially masquerading as legitimate WebSocket traffic.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (taskrunnersrvmod .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
Page 1 of 2