Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
7
1
1
Contributors
7
1
1
Categories
4
2
2
2
2
Platforms
7
1
1
Products / Services
6
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
Detects a game-delivered backdoor spawning cmd.exe with a command line unrelated to installation or game launch activity. The rule specifically looks for cmd.exe being spawned by processes with names containing 'bird', 'rok', 'game', 'launcher', 'update', 'python', or 'ruby', and executing a command line with '/c'.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.
Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.
Bazacall malware uses emails that contain a phone number for the user to call in order to cancel a fake subscription. These emails contain no links or attachments, and use automatic payment lures to trick users into contacting the number included in the email.
Bazacall uses malicious Excel files to execute payloads on affected devices.
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
During the chain of events from Bazacall to Bazaloader, RunDLL makes several network connections, including to command and control (C2) infrastructure. The command line for these connections contains a specific process paramter, ",GlobalOut" that can surface potentially malicious activity related to Bazacall and Bazaloader.