Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
1
1
1
Categories
3
2
1
1
Platforms
3
Products / Services
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects execution of BADAUDIO malware downloader used by APT24
Detects the execution of rundll32.exe with davclnt.dll to establish a WebDAV connection, a technique used by APT42 in the SpearSpecter campaign for initial access via malicious search-ms links. Specifically, it looks for rundll32.exe executing the DavSetCookie function from davclnt.dll and captures the WebDAV server from the command line argument.
Detects the execution of rundll32.exe with command-line arguments used to connect to a remote WebDAV share. This technique was observed in the SpearSpecter campaign where APT42 abused the 'search-ms' URI handler to deliver a malicious LNK file from an attacker-controlled WebDAV server.
