Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
35
12
11
10
3
Contributors
26
16
10
5
4
Categories
24
23
13
10
8
Platforms
70
3
Products / Services
24
23
8
6
5
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects network connections to the primary C2 domain (fruitbrat.com) used by the Mustang Panda PlugX variant in this campaign. Specifically flags HTTPS connections to this domain.
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
Detects an initial payload downloader, specifically 'Browser_Updater.exe', initiating network connections to retrieve an MSI payload disguised as an 'iis.jpg' file. This rule identifies suspicious network activity based on the process name and specific network indicators (IP address or URL pattern).
Detects the creation or modification of the non-standard registry key (ms-pu\CLSID) used by the Mustang Panda PlugX variant to store its 16-character hex client identifier. This specific registry path is highly indicative of PlugX activity.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
Detects the staging and installation of the G DATA Avk.exe sideloading set within the unexpected C:\Users\Public\GData\ directory, associated with a Mustang Panda PlugX campaign. This rule specifically looks for the creation of files named "Avk.exe", "Avk.dll", or "AVKTray.dat" in this suspicious public user directory.
Detects post-reboot persistence mechanism established by the Mustang Panda PlugX variant, utilizing a 'G Data' Run key and a suspicious staging path pointing to 'Avk.exe'. This rule specifically looks for registry key creations or value sets in the Run key where the value name is 'G Data' or the value data contains 'GData\Avk.exe'.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
Detects the execution of a malicious LNK file exploiting the ZDI-CAN-25373 vulnerability, a technique used by threat actors like UNC6384. The exploit involves padding the command line arguments with excessive whitespace to hide the malicious command from the user in the file's properties. This rule identifies command or powershell execution containing a large amount of whitespace characters, which is characteristic of this technique.
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
The following analytic detects the creation of a Windows Service with a binary path located in uncommon directories, using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify services installed outside typical system directories. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.
The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
The analytic detects a process enabling the "SeDebugPrivilege" privilege token, leveraging Windows Security Event Logs with EventCode 4703. This privilege allows a process to inspect and modify the memory of other processes, which can lead to credential dumping or code injection. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, an attacker could gain extensive control over system processes, enabling privilege escalation, persistence, or access to sensitive information.
This detection identifies unsigned DLLs loaded through DLL side-loading where the DLL shares the same file path as the process that loaded it. This technique is observed in malware like DarkGate and PlugX. The rule monitors DLL loading events, verifies digital signatures, and flags unsigned DLLs. It specifically excludes DLLs loaded from standard Windows system directories and Program Files to reduce false positives. Detecting such suspicious DLLs is crucial in preventing privilege escalation and other security breaches.
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Page 3 of 4