Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
3
1
Categories
4
3
3
3
3
Platforms
3
1
Products / Services
3
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
'This query identifies exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893) to the VPN server'
