Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
1
1
Contributors
3
3
1
1
Categories
3
3
3
2
1
Platforms
4
4
1
Products / Services
3
1
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the Finder application on macOS loading authentication modules (libpam.dylib) from within the 'Application Support' directory. The rule further correlates this by checking if common system utility tools (dscl, security, osascript) were initiated by the same Finder process path, flagging cases where legitimate system activity is absent, which may indicate potential dylib hijacking or suspicious process behavior.
Detects injection of malicious DYLIB libraries via LC_LOAD_DYLIB mechanism
Detects delivery of malicious dylib files for macOS library hijacking
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
This rule detects the creation of specific configuration files (`setup.exe.config` or `updateconfig.xml`) that are associated with AppDomain Hijacking techniques used by the Nimbus Manticore threat actor. This activity indicates an attempt to manipulate application configuration to execute malicious code.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\.
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'