Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
2
Contributors
5
2
Categories
5
1
1
Platforms
7
Products / Services
5
1
MITRE Techniques
2
2
CVEs
71
71
64
58
49
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Surfaces Microsoft Defender alerts that reference Candiru/DevilsTongue spyware terms or associated CVEs (such as CVE-2021-31979, CVE-2021-33771, etc.) attributed in threat intelligence reports.
Detects registry modifications associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, which were reportedly used by the threat group Sourgum with the DevilsTongue malware. Specifically, it looks for changes to the default values of InprocServer32 for specific CLSIDs, while filtering out legitimate system DLLs.
Detects the creation or modification of specific files associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, and the deployment of DevilsTongue malware by the threat group Sourgum. The rule specifically looks for the presence of certain filenames in critical system directories.