Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
13
3
3
2
1
Contributors
9
8
3
1
1
Categories
13
12
12
5
5
Platforms
13
9
Products / Services
13
13
4
3
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
8
5
IDS Protocols
8
5
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects HTTP traffic patterns associated with the VelvetCake malware used by North Korean threat actors Konni and Kimsuky. These signatures identify beaconing behavior to known free-hosting infrastructure, specifically monitoring for unique URL parameters ('OKey=', 'Who=', 'Areyou=cake') and common file naming conventions associated with the C2 communication.
Detects outbound HTTP POST requests associated with the VelvetCake malware and Konni threat actor to the command-and-control (C2) domain 'medianewsonline.com'. The rule matches specific URI patterns ('/logout.php') and query parameters ('OKey=', 'Who=', 'Areyou=') commonly used for reconnaissance and data exfiltration.
This rule detects malicious PowerShell execution originating from common Office or script-based parent processes (explorer.exe, mshta.exe, wscript.exe). The detection specifically looks for hidden command-line flags combined with indicators related to the Konni/VelvetCake campaign, such as specific artifact filenames (update1.vbs, update2.ps1) or remote downloads from raw.githubusercontent.com.
Detects the creation of a scheduled task named 'OneDriveUpdateScheduler' and the subsequent execution of 'update1.ps1' or 'update2.ps1' by 'explorer.exe'. This behavior is associated with the Konni/VelvetCake malware families, which use this technique to maintain persistence and C2 connectivity.
Detects execution of PowerShell commands initiated by LNK files, characteristic of Konni/VelvetCake spear-phishing campaigns. The rule monitors for PowerShell processes launched by shell applications (explorer, rundll32, etc.) using hidden windows and fetching specific malware-related filenames or downloading from AppData directories.
Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detects execution of PowerShell commands indicative of the VelvetCake variant of the Konni malware. The rule identifies the use of 'Net.WebClient.DownloadString' combined with 'Invoke-Expression' (iex) to execute scripts in memory, alongside specific command-line indicators such as the 'Areyou=cake' campaign marker or associated C2 domains.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule detects HTTP GET requests containing specific URI parameters (OKey, Who, Areyou=cake) indicative of communication patterns associated with the Konni and VelvetCake malware families during exfiltration or command-and-control operations.
Detects the execution of a PowerShell command that reads a file's byte stream and performs a XOR operation on it. This technique is used by the KONNI APT group to decrypt and execute an embedded payload in memory, as seen in their 2026 campaign involving AI-generated backdoors.
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
Page 1 of 2