Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
10
9
9
Contributors
28
Categories
15
9
3
3
3
Platforms
28
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
7
6
6
6
6
Correlates a Sysmon DriverLoad event matching known BTR.sys hashes with a subsequent System-process (PID 4) deletion of specific Defender binaries or WdFilter/WinDefend registry keys within a 10-second window — the definitive Defender self-destruction signature of the kernel primitive.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects creation of the Chaos ransomware ransom note file (readme.chaos.txt), dropped on affected systems during the STAC4749 campaign's ransomware deployment stage.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects access to the attacker-controlled sandbox/dependency-check file (C:\ProgramData\AppSreen\logs\appscreen.log) that the STAC4749 first-stage loader verifies before proceeding with execution.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Page 1 of 2