Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
16
3
1
Contributors
14
2
2
2
Categories
18
8
6
3
2
Platforms
16
4
Products / Services
16
2
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
16
IDS Protocols
7
7
2
Detects HTTP responses containing SocGholish (FakeUpdates) malware delivery signatures. The rule monitors for a 200 HTTP status code, a content type of 'javascript', and the presence of the specific string 'NDSW' in the response body, which is a known indicator of the SocGholish JavaScript-based loader.
Detects HTTP traffic patterns associated with the SocGholish Traffic Distribution System (TDS). The rule identifies an HTTP 302 redirect response where the 'Location' header points to a URL containing 'update' and a .js extension, a characteristic behavioral signature used by SocGholish for its drive-by-download campaigns.
Detects the creation of scheduled tasks using schtasks.exe initiated by command shells where the task command points to files residing in non-standard or user-writable directories such as \Users\Public\, \PerfLogs\, or \ProgramData\. This pattern is frequently utilized by malware loaders like SocGholish, GootLoader, and various ransomware strains to achieve persistence following initial compromise.
Detects the execution of 'node.exe' with 'Update.js' in its command line. This pattern is associated with the primary dropper for the 'Lorem Ipsum' malware.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (taskrunnersrvmod .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic. This pattern often involves a hexadecimal string followed by two subdomains and a top-level domain.