Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
1
MITRE Techniques
18,146
15,680
12,619
8,428
6,254
Detects the use of PowerShell to download files from Vultr Object Storage, specifically targeting patterns associated with the HEAVYGRAM malware distribution. The rule monitors for PowerShell cradles (WebClient, DownloadFile), archive extraction commands, or the execution of a specific payload name (RuntimeSSH.exe) often linked to the Handala Hack threat activity.
