Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
27
4
4
4
4
Contributors
17
15
11
Categories
22
19
13
12
11
Platforms
40
9
4
Products / Services
26
9
4
4
4
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
4
IDS Protocols
2
2
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects execution chains associated with the SideCopy threat group's ReverseRAT payload. The detection looks for mshta.exe being spawned by common shell processes (explorer, wscript, cmd, powershell) to execute remote HTA content or access 'docsportal.in'. It also monitors for subsequent reflective DLL loading via rundll32.exe or regsvr32.exe, which is indicative of the final ReverseRAT payload activation.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
Detects execution chains associated with the SideCopy threat group's ReverseRAT payload. The detection looks for mshta.exe being spawned by common shell processes (explorer, wscript, cmd, powershell) to execute remote HTA content or access 'docsportal.in'. It also monitors for subsequent reflective DLL loading via rundll32.exe or regsvr32.exe, which is indicative of the final ReverseRAT payload activation.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
High fidelity detection combining the specific firefx-* staging directory pattern with the .vmxx shellcode file extensions, indicative of Operation XENOFISCAL activity. This rule identifies the creation or modification of files with '.vmxx' extension or specific filenames ('ayui.vmxx', 'ayhui.vmxx') within a suspicious 'C:\Users\Public\firefx-[a-f0-9]+-[0-9]+\' directory pattern, which is known to be used by the SideCopy threat group.
Detects user or script launching regedit.exe with command lines targeting the specific 'Edgre' run key, which is associated with persistence mechanisms used by the XenoRAT malware.
This rule detects the execution of processes containing the string "zuidrt" or the execution of 'mshta.exe', followed by a network connection to the known XenoRAT C2 IP address 185.235.137.106. This correlation aims to identify XenoRAT payload execution and subsequent communication with its command and control server, as observed in Operation XENOFISCAL.
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
Detects process executions originating from the XenoUpdateManager task that immediately initiate outbound network connections. This behavior is associated with Operation XENOFISCAL, where the SideCopy threat group deploys XenoRAT.
This rule detects the execution of mshta.exe with a command line that includes a remote fetch to 'abimj.edu.af/index.php'. It then correlates this activity with subsequent child process spawning, indicating potential malicious activity associated with the Operation XENOFISCAL campaign.
This rule detects the creation or modification of a registry run key named "Edgre" where the associated value data points to the `C:\Users\Public\` directory. This behavior is associated with the Operation XENOFISCAL campaign, specifically for establishing persistence by placing malicious payloads in a publicly accessible user directory.
Detects mshta executing the malicious URL/HTA but wrapped with caret (^) obfuscation typical of SideCopy.
Detects mshta executing any HTA file originating from the anomalous C:\Users\Public\USOShared-* path, as observed in Operation XENOFISCAL.
This rule connects the creation of the 'Edgre' persistence registry key, which contains 'zuidrt.hta', to the actual process execution of 'zuidrt.hta'. This activity is associated with Operation XENOFISCAL, where the SideCopy threat group deploys the XenorRAT malware.
Detects any process executing files with .vmxx extensions residing within the anomalous firefx- directories, which is indicative of activity related to Operation XENOFISCAL, specifically the deployment of persistent XenorRAT by the SideCopy threat group.
Correlates the file creation of zuidrt.hta and its execution via mshta.exe, indicating potential malicious activity associated with Operation XENOFISCAL.
Detects if schtasks is modifying an existing XenoUpdateManager task, indicating payload updating, as observed in Operation XENOFISCAL.
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
Page 2 of 3