Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
2
Contributors
3
2
1
1
Categories
3
1
1
1
1
Platforms
6
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
This rule detects the installation of a Windows service named 'NtsSrv' with an ImagePath ending in ' LocalService'. This specific service name and image path pattern are associated with the StoneDrill wiper malware, as described in Kaspersky's research.
This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
Detects process creation activity related to the Peach Sandstorm APT, specifically looking for a unique string 'QP's\*(58vaP!tF4' in the command line. This string is likely a unique identifier or a specific parameter used by the APT's tools.
Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.