Abhishek Kumar
@MaverickCompletionist
0 followers23 downloads43 copies0 likes22,496 views
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Categories
2
1
1
Platforms
3
Products / Services
2
1
MITRE Techniques
2
1
1
1
1
This rule detects suspicious activity related to 'wermgr.exe' or the named pipe 'MiniPlasmaWERPipe'. 'wermgr.exe' is the Windows Error Reporting process, and its execution from non-standard paths can indicate compromise or abuse. The 'MiniPlasmaWERPipe' named pipe has been associated with malware for inter-process communication. Detection is based on Windows Security Event Log (EventCode 4688 for process creation) or Sysmon Operational logs (EventCode 1 for process creation, 17 for pipe creation, 18 for pipe connection).
SPL Query
This detection rule identifies potential DLL sideloading activity associated with the Lotus Blossom threat actor's Chrysalis backdoor. It searches for specific legitimate executables, often renamed from security products, loading suspicious DLLs from the same directory. The rule specifically looks for `BluetoothService.exe` loading `log.dll` or `tmdbglog.exe` loading `tmdglog.dll`, where both the process and the DLL reside in the same directory.