Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
16
6
3
2
1
Contributors
17
3
3
2
2
Categories
18
10
7
6
6
Platforms
16
11
5
2
Products / Services
16
2
1
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
16
IDS Protocols
7
7
2
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
Detects a sequence of events where a user visits a Cloudflare Pages URL (*.pages.dev) and shortly after, a suspicious command (mshta, powershell, or curl) is executed. This pattern is consistent with the UNC5142 threat actor's TTP of using social engineering lures hosted on Cloudflare Pages to trick users into running malicious commands.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects the execution of the 'xattr -c' command on a macOS endpoint. This command is used to clear all extended attributes from a file, including the 'com.apple.quarantine' attribute set by Gatekeeper on downloaded files. UNC5142 uses this technique to bypass macOS security prompts before executing downloaded malware like the ATOMIC infostealer.
Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
Page 2 of 2