Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
3
1
1
Categories
4
3
3
3
3
Platforms
4
1
1
Products / Services
3
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects the deactivation or disabling of the Windows Scheduled Defragmentation task, which has been observed as a tactic used by the Slingshot APT group to hinder forensic analysis or system maintenance.
