Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
2
2
1
1
Categories
3
2
2
2
2
Platforms
3
2
1
1
Products / Services
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
COLDRIVER ROBOT chain - DNS lookup for TI delivery/C2 domains
Detects COLDDRIVER malware loading specific malicious DLLs (machinerie.dll, checkme.dll, iamnotarobot.dll) via rundll32.exe, or the loading of specific malicious DLLs identified by their SHA256 hashes.
This rule detects the execution of 'rundll32.exe' with suspicious DLL names in the command line, specifically 'machinerie.dll', 'checkme.dll', or 'iamnotarobot.dll'. Additionally, it identifies the loading of specific malicious DLLs by their SHA256 hashes, which have been associated with ColdRiver (Star Blizzard) activity. This behavior is indicative of potential malware execution or persistence mechanisms.
KQL Query from file: Threat Hunting Nation State Actors
KQL Query from file: Detecting Nation State Actors @ Near Realtime
'This query idenifies when rundll32.exe executes a specific set of inline VBScript commands
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
