hightestEmerging Threat
Lazarus System Binary Masquerading
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
windowsprocess_creation
2023-03-10
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
criticaltestEmerging Threat
Lazarus Group Activity
Detects different process execution behaviors as described in various threat reports on Lazarus group activity
windowsprocess_creation
2023-03-10
hightestEmerging Threat
Lazarus APT DLL Sideloading Activity
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
windowsimage_load
2026-11-02