Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
4
Categories
2
1
1
1
Platforms
4
Products / Services
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects outbound network connections initiated by msbuild.exe to common C2 ports (80, 443), which could indicate the use of Silenttrinity or other MSBuild-based execution for command and control.
Detects the loading of a DLL associated with the SILENTTRINITY stager, specifically looking for the string 'st2stager' in the DLL's description.
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.