Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
2
1
1
Categories
3
3
2
1
Platforms
4
Products / Services
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
Detects the anomalous execution of Node.js from non-standard, user-writable directories or when spawned by a shell process. This behavior is indicative of the Tsundere Bot backdoor, often used by TA584. The rule specifically looks for node.exe running from common user-writable or temporary directories (AppData\Local, Users\Public, Temp) or when initiated by command-line shells like powershell.exe or cmd.exe.
Detects the execution of Node.js (node.exe) when spawned by PowerShell or the Command Prompt from a user-writable directory. This behavior is characteristic of the Tsundere Bot delivery chain used by threat actors like TA584 (Storm-0900), who use a PowerShell script to install and run the Node.js-based malware.
