Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
7
Contributors
6
1
Categories
4
4
3
3
2
Platforms
7
Products / Services
7
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
Detects SystemSettings.exe running from user-writable AppData or ProgramData directories, or SystemSettings.dll being loaded by SystemSettings.exe from these locations. This behavior is indicative of SharkLoader DLL sideloading, often used as a first stage in attacks.
This rule detects the creation and execution of scheduled tasks used by StrikeShark's SharkLoader, often associated with Cobalt Strike, for persistence. It identifies suspicious scheduled task names that mimic legitimate Microsoft services (e.g., OneDrive, MicrosoftUpdate) and the execution of 'SystemSettings.exe' from unusual 'AppData' subdirectories ('xwreg' or 'xgdf'). The rule has three branches: detecting 'schtasks.exe' command-line usage to create such tasks, detecting 'ScheduledTaskCreated' events with the suspicious names or command patterns, and detecting 'SystemSettings.exe' execution from the specific 'AppData' subdirectories.
Detects the execution of `cmd.exe` with the `/c` argument to open a PDF file, originating from specific `AppData` subdirectories. This behavior is consistent with the SharkLoader dropper, often associated with the StrikeShark campaign, which uses decoy PDF documents to initiate its infection chain.
Detects process parent ID (PPID) spoofing where a process spawned by SystemSettings.exe claims a parent that is not SystemSettings.exe, svchost.exe, services.exe, or explorer.exe. This behavior is indicative of SharkLoader attempting to disguise Cobalt Strike Beacon process lineage using UpdateProcThreadAttribute/PROC_THREAD_ATTRIBUTE_PARENT_PROCESS. The rule also looks for suspicious process paths associated with SharkLoader.
Detects SystemSettings.exe executing from any directory other than its legitimate location (C:\Windows\ImmersiveControlPanel\). This behavior is indicative of DLL side-loading, often used by malware like SharkLoader to execute malicious SystemSettings.dll.
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
