Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
3
Categories
2
2
2
1
1
Platforms
3
Products / Services
2
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.