Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
Platforms
2
Products / Services
1
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
