Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
1
1
1
Contributors
2
1
1
1
1
Categories
2
2
2
1
1
Platforms
5
1
1
1
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
This rule monitors the rnpkeys.exe process for suspicious environmental reconnaissance activity, specifically targeting locale/keyboard-layout registry queries or domain enumeration via command-line tools. These activities are identified as occurring in a strict temporal sequence (pre-registration check) shortly before an initial outbound network connection, consistent with the behavior of the Sauron loader malware.
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
Correlates an outbound public-IP lookup (api.ipify.org/ifconfig.me) with a subsequent PBKDF2/SHA-256/XOR-referencing decode operation within 30 seconds on the same process, consistent with DOUBLECUP's environmental-keying anti-sandbox technique.
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
KQL Query
