Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
1
1
1
1
Contributors
1
1
1
1
Categories
3
2
1
1
1
Platforms
2
2
1
1
Products / Services
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
ET TROJAN Microsoft ClickFix IOC IP
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
