Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
2
1
1
1
1
Categories
4
3
1
1
1
Platforms
6
1
1
Products / Services
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
Detects Elise backdoor activity used by APT32
Detects Elise backdoor activity used by APT32
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_elise.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects Elise backdoor activity, specifically looking for the creation of a svchost.exe process in a suspicious path and the deletion of a NavShExt.dll file, which are indicators of the Elise malware used by APT32.
