Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
1
1
1
1
1
Platforms
3
Products / Services
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
This rule detects the execution of a specific Chinese-named payload, '_計畫申請審查結果通知單.exe', which is associated with the Dragon Weave campaign and the AZUREVEIL attack flow. It also correlates this process execution with the presence of 'BrowserViewUtility.exe' as an initiating process file event, indicating a multi-stage infection.
Detects indicators of compromise (IOCs) associated with the GOLD BLADE threat group's July 2025 campaign, including file hashes and C2 domains.
