Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
2
1
1
1
Categories
3
2
2
2
2
Platforms
3
2
Products / Services
2
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
2
This rule monitors HTTP traffic for requests containing 'bp.dat', which is associated with the registration phase of the Latrodectus malware downloader. It detects both URI-based and request body-based attempts by an infected host to register with a command and control server.
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects persistence and execution artifacts associated with the Latrodectus malware. This includes the creation of a misspelled registry run key ('sentinelssheduler') and the execution of a payload masquerading as SentinelOne from a non-standard AppData path.
Detects a suspicious sequence where a JavaScript file is executed, followed shortly by the execution of a Windows Installer (MSI) package on the same host. This pattern is consistent with the initial access technique used by threat actors like Lunar Spider, where a malicious script downloads and runs a subsequent payload.
Detects the creation of a scheduled task by a process named 'lsassa.exe', a .NET backdoor used by Lunar Spider. The malware masquerades as the legitimate 'lsass.exe' process and establishes persistence by creating a task that runs on startup.
