Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
10
9
9
Contributors
28
Categories
15
9
3
3
3
Platforms
28
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
7
6
6
6
6
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Page 2 of 2