Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

Medium>Splunk security content

Windows NorthStar C2 Agent Execution

Detects the initial agent or persistent agent processes for Northstar C2 being run. NorthStarC2 is an open-source command and control framework developed for penetration testing and red teaming purposes by Engin Demirbilek. NorthStar C2 Framework consists of two applications, a server-side GUI web application for managing sessions and a client-side stager to communicate with C2 server.

ATT&CK coverage

Outside the enterprise matrix

T1204.002Malicious File 101 detections cover this technique
T1547.001Registry Run Keys / Startup Folder 50 detections cover this technique
T1608Stage Capabilities 10 detections cover this technique

Detection requirements

Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Raven Tait
Splunk
Licence: Apache-2.0Read the licence
Published: Aug 26, 2026
Version: 1