Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
12
11
10
3
Contributors
26
16
10
5
4
Categories
24
23
13
10
8
Platforms
70
3
Products / Services
24
23
8
6
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of known Jarte-derived host processes (GRrte.exe or Jarte.exe) which are commonly leveraged as side-loading proxies for the PlugX remote access trojan. The rule flags the process initiation as a proxy indicator for the subsequent execution of PlugX's modular payload, which performs system enumeration and process discovery.
Detects the execution of known Jarte-derived host processes (GRrte.exe or Jarte.exe) which are commonly leveraged as side-loading proxies for the PlugX remote access trojan. The rule flags the process initiation as a proxy indicator for the subsequent execution of PlugX's modular payload, which performs system enumeration and process discovery.
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
This rule detects the creation or modification of registry run keys associated with the JartePortable application. The detection logic looks for persistence mechanisms that point to executable paths in public directories or specific registry value data associated with known PlugX malware activity.
This rule detects the creation or modification of registry run keys associated with the JartePortable application. The detection logic looks for persistence mechanisms that point to executable paths in public directories or specific registry value data associated with known PlugX malware activity.
This rule detects network activity associated with the PlugX RAT, specifically monitoring for DNS lookups of 'images.hcgtest.net', direct IP connections to '104.21.77.221', and HTTP requests to '/download/ar96rhqjgw2' using a user-agent containing 'curl'. This pattern indicates a compromised host attempting to download a PlugX archive.
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Detects DLL sideloading attempts associated with the Red Lamassu threat activity. The rule monitors for common Windows system binaries (odbcconf.exe, regsvr32.exe, rundll32.exe, and svchost.exe) loading DLL files from user-writable directories such as Temp, Downloads, AppData, and ProgramData, while filtering out legitimate loads from standard system paths.
Modular remote access trojan associated with long-term espionage intrusions
PlugX C2Beacon
YARA
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
PlugX NetworkIOC
YARA
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Modular remote access trojan associated with long-term espionage intrusions
Detects the co-occurrence of JFMBackdoor DLL sideloading via fltMC.exe and an additional PlugX DLL sideloading event originating from a temporary directory on the same host. This pattern is indicative of the Red Lamassu actor group deploying shared tooling for lateral movement and persistence.
Page 2 of 4