Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
114
59
26
14
14
Contributors
78
29
27
23
19
Categories
170
137
66
57
39
Platforms
207
22
19
9
2
Products / Services
97
54
31
25
11
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
This rule detects instances where PowerShell is spawned by Windows Script Host processes (wscript.exe or cscript.exe) with suspicious command-line arguments indicative of fileless execution or payload decoding, such as the use of hidden windows, encoded commands, or certutil-based file decoding from the ProgramData directory.
Detects usage of the Windows certutil.exe utility with flags commonly associated with malicious activity, including downloading files from remote URLs or decoding/encoding files within temporary or application data directories.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects the abuse of the Windows built-in Certutil.exe utility for deobfuscating files or downloading remote content. This rule identifies common patterns associated with malicious activity, including the decoding of encoded files and the use of the urlcache flag to download remote files, which are techniques often used to bypass security controls and retrieve second-stage payloads.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects the use of certutil.exe to download files from remote URLs using the -urlcache flag or decode files using the -decode flag. This behavior is indicative of a living-off-the-land technique used by adversaries to fetch or prepare malicious payloads.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects the execution of JScript Encoded (.jse) files via wscript.exe or cscript.exe when spawned by Office applications or email clients. This pattern is indicative of Kimsuky initial stage payloads, where a malicious lure file is dropped into a user-writable directory (e.g., Temp, AppData, Downloads) and subsequently executed.
Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects wscript.exe executing PowerShell to run a script dropped into the C:\Temp directory. This behavior is consistent with common JScript dropper infection chains, such as Amadey or StealC, which use WScript to decode and execute Base64 payloads from temporary files using hidden windows and bypassed execution policies.
Detects the use of certutil.exe to download files from remote URLs using the -urlcache flag or decode files using the -decode flag. This behavior is indicative of a living-off-the-land technique used by adversaries to fetch or prepare malicious payloads.
Detects the LegionLoader malware behavior where a password-protected .dat archive is created in the AppData\Roaming directory followed by the execution of 7z.exe or 7za.exe to extract the hidden payload.
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Hunts for custom PowerShell RC4 decryption routines utilizing hardcoded byte arrays to unhook AMSI or decode subsequent stages. This rule specifically looks for PowerShell command text containing patterns indicative of byte array assignments (e.g., `]$var = 0x...`) and the `bxor` operator, which is commonly used in RC4 decryption routines.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the use of the Windows certutil.exe utility for potentially suspicious file operations, including downloading files from remote URLs via 'urlcache' or 'split', or encoding/decoding files. This is a common Living-off-the-Land (LotL) technique used by attackers to stage malicious payloads or deobfuscate malicious content.
Page 7 of 13