Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
12
10
3
1
1
Contributors
15
6
2
2
2
Categories
13
7
7
4
4
Platforms
27
3
3
3
Products / Services
22
5
3
3
3
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects the DLL sideloading of the Kazuar v3 loader (hpbprndiLOC.dll) by a legitimate Hewlett-Packard printer driver installer (hpbprndi.exe). This technique is used by Turla to initiate its infection chain.
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects potential DLL side-loading of the Turla Kazuar backdoor using legitimate executables launched from unusual, actor-specific file paths.
Page 2 of 2