Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
3
Products / Services
2
1
1
1
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
Detects the creation of .aspx, .ashx, or .asp files within Exchange OWA/ECP or IIS wwwroot directories by web server processes (w3wp.exe or UMWorkerProcess.exe). This pattern is consistent with web shell deployment following the exploitation of public-facing web applications, a technique often used by threat actors like APT40.
This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.
Detects command line patterns associated with the threat actor Bonadan (also known as APT27, Emissary Panda, Lucky Mouse, Bronze Union, G0065). This rule identifies the use of certutil for decoding payloads, wmic for process creation, and schtasks for persistence in suspicious directories.
