Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
3
1
Platforms
3
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
This rule detects registry modifications associated with the Ke3chang/TidePool malware families. Specifically, it looks for command-line arguments used to modify the 'Check_Associations', 'DisableFirstRunCustomize', and 'IEHarden' registry keys. These modifications are known to be unique to these malware families and were observed in campaigns in 2019 and 2020.
