Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
Detects the creation of malicious DLL files used for side-loading by the Ashen Lepus group's AshTag malware suite. These DLLs are often dropped in non-standard locations to be loaded by legitimate executables.
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
