Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
KQL Query from file: One-Click ANY RUN Storm-1747 KQL Scan
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Identifies suspicious access to sensitive browser files by processes commonly used by Lumma Stealer, expanding coverage to include more browsers based on observed configurations.
"This query searches for any files in Cloud App Events that have trigger a security alert."
'This hunting query will identify where a file is uploaded to Azure File or Blob storage
and is then accessed once before being deleted. This activity may be indicative of
exfiltration activity.'
and is then accessed once before being deleted. This activity may be indicative of
exfiltration activity.'
This query was originally published in the threat analytics report, CVE-2020-0601 certificate validation vulnerability.
The Windows CryptoAPI Spoofing Vulnerability, CVE-2020-0601, can be exploited to spoof code-signing certificates. For example, an attacker could forge a certificate that lists Microsoft as the issuer. This would allow an attacker to disguise a malicious executable as legitimate.
The vulnerability was patched with the January 2020 Security Update.
Use the following query to locate files containing ECC certificates that might have been forged using this vulnerability. The query identifies files that don't correctly identify the signer name, yet list Microsoft as the root signer.
References:
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2020-0601
https://portal.msrc.microsoft.com/security-guidance/releasenotedetail/2020-Jan
The Windows CryptoAPI Spoofing Vulnerability, CVE-2020-0601, can be exploited to spoof code-signing certificates. For example, an attacker could forge a certificate that lists Microsoft as the issuer. This would allow an attacker to disguise a malicious executable as legitimate.
The vulnerability was patched with the January 2020 Security Update.
Use the following query to locate files containing ECC certificates that might have been forged using this vulnerability. The query identifies files that don't correctly identify the signer name, yet list Microsoft as the root signer.
References:
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2020-0601
https://portal.msrc.microsoft.com/security-guidance/releasenotedetail/2020-Jan
Private Key Files.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
Total Controlled Folder Access events.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
The analytic detects potential access or modification of the /etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file. This activity is significant because the sudoers file controls user permissions for executing commands with elevated privileges. If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects attempts to access files in the local path that contain Outlook emails.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects attempts to access files in the local path that contain Outlook emails.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
The analytic detects suspicious access or modification of the sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is significant because unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk.
Find Mounted ISO files and drive letters
Detects the execution of common text-based file access or inspection utilities to read the content of the '/etc/sudoers' file on Linux systems. This activity is often performed by adversaries to discover users with sudo rights, which can be a precursor to privilege escalation.
Detects suspicious processes based on name and location that access the Windows Credential Manager and Vault. This activity can be indicative of credential stealing, such as that performed by Mimikatz's "dpapi::cred" function.
This rule detects attempts by uncommon applications to access Windows Data Protection API (DPAPI) Master Keys. Such access can indicate credential theft, for example, through tools like Mimikatz's "dpapi::masterkey" function. The rule specifically looks for file access requests to the DPAPI master key directories for both system and user accounts, while filtering out access from common system and program files locations to reduce false positives.
Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing, for example, the usage of Mimikatz's "dpapi::credhist" function. The rule filters out common legitimate system processes and applications to reduce false positives.
Detects file access requests to Windows Outlook Mail data files by uncommon processes. This could indicate a potential attempt to steal credentials or sensitive information from Outlook mailboxes. The rule requires significant baselining to reduce false positives.
Page 73 of 76