Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
12
10
3
1
1
Contributors
15
6
2
2
2
Categories
13
7
7
4
4
Platforms
27
3
3
3
Products / Services
22
5
3
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects DLL side-loading activity associated with the Kazuar backdoor, where legitimate executables (LaunchGFExperience.exe or vncutil64.exe) are executed from unusual directories (Brother Printer or Sony Audio drivers) to load a malicious DLL (LaunchGFExperienceLOC.dll).
Detects potential second-stage deployment of the Kazuar backdoor on Windows hosts, following initial access activity associated with the Gamaredon group (using Ptero-family implants). The rule monitors for a sequence involving PowerShell-based loaders (PteroPaste, PteroVDoor, PteroSetup, or PteroDee) followed by or combined with suspicious encoded PowerShell commands and the creation of Kazuar-specific named pipes or artifact markers.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
Detects registration or activation of a .NET COM object from a writable path before an in-memory payload is supplied. This rule specifically looks for command-line arguments containing COM-related keywords (regasm, regsvcs, comvisible, clsid, inprocserver32) in conjunction with common writable user-controlled directories (appdata, programdata, temp, users\public).
Detects the Kazuar malware removing job instructions and result files from its working directory after exfiltration or task completion. This rule specifically looks for file deletion events (EventCode 23 or 26 in Sysmon) where the file path matches patterns indicative of task, job, result, output, or stage files with common extensions like json, dat, bin, txt, or zip.
Detects a module parsing a large in-memory configuration blob without opening an external configuration file in the same start window. This behavior is indicative of the Kazuar malware loading its configuration directly from its executable rather than a separate file, which is a common obfuscation technique.
Detects a script process creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
Detects a persistent module loading a previously unseen DLL from its task or plug-in directory after local IPC activity. This behavior is associated with the Kazuar malware.
Detects repeated creation attempts for the same mutex, pipe, lock file, or loopback endpoint by several module processes, leaving one active leader. This behavior is indicative of the Kazuar malware establishing a leader election mechanism to coordinate its activities on a compromised system.
Detects a module enumerating local processes, named pipes, loopback listeners, mutexes, or shared-memory sections to locate bot peers, indicative of Kazuar malware activity.
Detects a 'bridge', 'kernel', 'service', or 'host' process repeatedly starting a 'worker', 'plugin', or 'module' process after short runtimes, indicating watchdog and resilience logic. This behavior is associated with the Kazuar malware.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects a persistent process creating similarly sized outbound transfers at regular intervals after staging local results, indicative of the Kazuar malware's exfiltration behavior. The rule identifies processes with significant outbound network traffic (bytes > 10000), aggregates this traffic over 15-minute intervals, and then looks for processes that exhibit consistent outbound activity with intervals between 10 and 20 minutes (600 to 1200 seconds).
Detects a newly launched module creating a hidden or randomly named working directory used to stage configuration, tasks, and output. The rule specifically looks for file creation events (EventCode=11) in common application data directories (appdata, programdata, temp) where the filename matches a pattern indicative of a hidden or randomly named directory followed by specific subdirectories like 'config', 'tasks', 'jobs', 'output', or 'cache'.
Detects a dropper deriving a decryption key from hostname or machine attributes before unpacking a second-stage module. The rule specifically looks for process command lines containing keywords related to hostname/computername/machineguid/volume serial combined with decryption-related terms like decrypt, aes, xor, payload, or byte array.
Page 1 of 2