Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
12
11
10
3
Contributors
26
16
10
5
4
Categories
24
23
13
10
8
Platforms
70
3
Products / Services
24
23
8
6
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects the OIC-lure Mustang Panda PlugX infection chain with tightened false-positive controls: requires the console-resize artifact (mode.com with digit,digit args) that precedes the download, requires PowerShell to be parented directly by explorer.exe (filtering out legitimate scheduled-task/management-agent automation that also chains curl+tar), requires curl to combine -L with -k/-s (insecure/silent) flags, narrows all correlation windows to 2 minutes, and excludes shell/utility processes from the final execution match.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Detects DLL side-loading where a known legitimate signed executable, often associated with security utilities, loads a DLL from a non-standard, user-writable directory (such as Temp, AppData, or ProgramData). This behavior is characteristic of APT10's (Stone Panda/Cicada) historical tradecraft in MSP environments to execute modular PlugX RAT payloads.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
This rule detects potentially malicious in-memory activity within the 'GRrte.exe' process, specifically targeting behaviors associated with PlugX malware. It monitors for suspicious memory protection changes (e.g., requests for Read-Write-Execute permissions) and the loading of the 'ws2_32.dll' library, which is commonly used to facilitate network communication in side-loaded payloads.
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Detects high-volume file/directory enumeration behavior by the PlugX side-loaded process GRrte.exe, consistent with PlugX's use of FindFirstFileW/FindNextFileW/FindFirstFileExW for file and directory discovery (T1083).
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
This rule detects known side-loaded PlugX RAT host processes ('GRrte.exe' or 'Jarte.exe') located in 'JartePortable' directories attempting to modify process tokens or privileges. This behavior is indicative of privilege escalation preparation, a common activity for the PlugX modular RAT.
Detects execution of the PlugX side-loaded host process (Jarte.exe / GRrte.exe) from the JartePortable directory. This process performs in-memory host/system profiling (GetComputerNameW, GetVersionEx, system directory queries) via the decoded PlugX core (T1082), which is not directly visible as command-line telemetry.
Detects execution of the PlugX side-loaded host process (Jarte.exe / GRrte.exe) from the JartePortable directory. This process performs in-memory host/system profiling (GetComputerNameW, GetVersionEx, system directory queries) via the decoded PlugX core (T1082), which is not directly visible as command-line telemetry.
Page 1 of 4