Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
15
5
4
2
1
Contributors
9
8
3
2
2
Categories
10
8
8
7
4
Platforms
27
1
Products / Services
14
7
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the creation of specific files associated with AppDomain hijacking by the Nimbus Manticore threat actor. It looks for the creation of files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' directory. The rule is tuned to trigger when at least two distinct campaign files are created within a 10-minute window on the same device.
Detects the creation of specific .NET configuration files (.config) used by Screening Serpens for AppDomainManager hijacking, alongside known malicious DLLs. This rule correlates the creation of the campaign's specific config file names with the deployment of its associated payloads in the same folder within a short time frame.
Detects the creation or modification of .NET application configuration files (`.exe.config`) in sensitive framework directories. This is a technique known as AppDomain Hijacking, used by the Silver Dragon APT group to hijack legitimate Windows services like `dfsvc.exe` and `tzsync.exe` for persistence and to load their malware (MonikerLoader).
This rule looks for a common hijacking method involving modification of the AppDomainManager in .NET applications. The 'dfsvc.exe' process can be relocated or renamed, and when paired with a crafted config file, may execute malicious code from DomainManager.dll before the application loads.
Detects potential AppDomainManager hijacking used by the OneClik APT campaign, where legitimate .NET ClickOnce applications (ZSATray.exe, umt.exe, ied.exe) load a suspicious DLL like 'history.tlb'. This technique (T1574.014) is used to load attacker-controlled assemblies and execute malicious code.
This rule detects the use of potentially suspicious keywords within PowerShell scripts that are often associated with exploitation frameworks or advanced attack techniques. Specifically, it looks for reflection-related keywords like 'System.Reflection.Assembly.Load', '[System.Reflection.Assembly]::Load', '[Reflection.Assembly]::Load', 'System.Reflection.AssemblyName', 'Reflection.Emit.AssemblyBuilderAccess', 'Reflection.Emit.CustomAttributeBuilder', and keywords related to interop services and process manipulation such as 'Runtime.InteropServices.UnmanagedType', 'Runtime.InteropServices.DllImportAttribute', 'SuspendThread', and 'rundll32'. These keywords can indicate attempts to load assemblies in-memory, interact with unmanaged code, or manipulate processes, which are common tactics used by malware and red teaming tools.
Page 2 of 2