Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
3
2
Categories
3
3
2
2
1
Platforms
5
1
Products / Services
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Detects processes associated with Dohdoor malware making network connections to Cloudflare's DNS-over-HTTPS service for C2 domain resolution.
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
Detects a Windows program being run from a shared folder instead of its normal location, with an unusual command added. This can be a sign that a clean program was copied and used to run a harmful file.
Detects known file hashes and C2 domains associated with the Dohdoor malware campaign. This rule combines file and network indicators; it may need to be split into two separate rules (e.g., for file events and network events) depending on the SIEM implementation.