• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Abuse.ch Recent Threat Feed

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•3•0•43

    This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.

    Microsoft Sentinel (KQL)

    Tags

    T1566 - PhishingT1003 - OS Credential DumpingT1059 - Command and Scripting InterpreterT1055 - Process InjectionT1588.001 - MalwareT1587.001 - MalwareT1608.001 - Upload MalwareS1139 - INC RansomwareS1180 - BlackByte RansomwareS1181 - BlackByte 2.0 RansomwareTA0002 - ExecutionT1480 - Execution GuardrailsT1204 - User ExecutionTA0003 - PersistenceT1070.009 - Clear PersistenceT1128 - Netsh Helper DLLTA0004 - Privilege EscalationT1068 - Exploitation for Privilege EscalationT1078.003 - Local AccountsTA0006 - Credential AccessTA0001 - Initial AccessTA0005 - Defense EvasionTA0042 - Resource DevelopmentMalware DetectedFile EventProcess EventImage LoadWindowsWindows Defender Atpkqltactic:Executiontactic:Persistencetactic:Privilege escalationtactic:Credential Accesstactic:Discoverytactic:Impacttactic:Exploittactic:Malware, componenttactic:Ransomware

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?