Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects process creation events indicative of the Griffon malware. Specifically, it looks for command-line arguments that contain all of the following strings: '\local\temp\', '//b /e:jscript', and '.txt'. This pattern suggests the execution of a JScript file from a temporary directory, which is a known behavior of Griffon malware as reported by Kaspersky.
