Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
This rule detects the use of the JamPlus build tool for potentially malicious execution. It specifically looks for HTTP traffic where the URI contains 'jamplus' or 'jam.exe' and the file data starts with 'MZ', indicating an executable file download. This combination suggests an attempt to deliver or execute a malicious JamPlus-compiled executable.
Detects JamPlus build automation tool abused for malicious proxy execution
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
