Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
This rule detects the execution of a specific Chinese-named payload, '_計畫申請審查結果通知單.exe', which is associated with the Dragon Weave campaign and the AZUREVEIL attack flow. It also correlates this process execution with the presence of 'BrowserViewUtility.exe' as an initiating process file event, indicating a multi-stage infection.
Correlates the reading of the '1.dat' container file, which is required for secondary stage decryption, with the execution of 'RuntimeBroker_update.exe'. This activity is indicative of the 'Dragon Weave' campaign.