Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,347 detections
Filters
Last updated
All Time
Detection languages
1,335
1,010
316
198
184
Contributors
960
506
379
300
209
Categories
20,440
11,814
5,871
5,145
4,864
3,347
Platforms
3,332
17
14
12
7
Products / Services
1,535
805
641
458
291
MITRE Techniques
2,512
2,391
1,392
461
413
CVEs
4
4
4
3
3
IDS Classtypes
10
2
2
1
IDS Protocols
13
3
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_apt29_thinktanks.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI.
This query was originally published in the threat analytics report, Operation Soft Cell.
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query was originally published in the threat analytics report, Doppelpaymer: More human-operated ransomware. There is also a related blog.
DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.
The following query detects attempts to stop security services.
The See also section below lists links to other queries associated with DoppelPaymer.
References:
https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
DoppelPaymer is ransomware that is spread manually by human operators. These operators have exhibited extensive knowledge of system administration and common network security misconfigurations. They often use stolen credentials from over-privileged service accounts to turn off security software, run malicious commands, and spread malware throughout an organization.
The following query detects attempts to stop security services.
The See also section below lists links to other queries associated with DoppelPaymer.
References:
https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoppelPaymer!MTB&threatId=-2147205372
This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query finds evidence of an Exchange PowerShell snap-in being loaded. This can indicate an attempt to exfiltrate data.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query finds evidence of an Exchange PowerShell snap-in being loaded. This can indicate an attempt to exfiltrate data.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
This query identifies the launch pattern associated with wastedlocker ransomware.
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
Identify masqueraded DLLHost.exe file created by PowerShell.
Identify PowerShell creating an exclusion path of ProgramData directory for Microsoft Defender to not monitor.
Detects potential PowerShell commands or code within registry run keys
The analytic detects changes to the PowerShell ExecutionPolicy in the registry to "Unrestricted" or "Bypass." This activity is significant because setting the ExecutionPolicy to these values can allow the execution of potentially malicious scripts without restriction. If confirmed malicious, this could enable an attacker to execute arbitrary code, leading to further compromise of the system and potential escalation of privileges.
This rule detects the execution of PowerShell commands that utilize the `FromBase64String` function. This function is commonly used by adversaries to decode base64 encoded strings, which often contain obfuscated malicious commands or payloads. The rule specifically looks for the string `::frombase64string(` in the command line arguments of a process.
This rule detects the execution of PowerShell commands that utilize the `System.Net.WebClient` object to download files using the `DownloadFile` method. This is a common technique used by adversaries to retrieve malicious payloads or tools from remote servers.
Detects the usage of the "ConvertTo-SecureString" cmdlet via the command line within PowerShell or pwsh.exe processes. This activity is generally uncommon and could indicate suspicious behavior, as it is often used to handle sensitive information like passwords, which attackers might try to extract or manipulate.
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
This rule detects the use of the '::FromBase64String(' function in a command line, which is a common method for decoding Base64 encoded strings in PowerShell. Adversaries often use Base64 encoding to obfuscate malicious commands or payloads, making them harder to detect by signature-based defenses. This detection aims to identify attempts to deobfuscate such encoded content, typically as part of a larger attack chain involving defense evasion and execution.
Detects attempts to clear Windows Event Logs using 'wevtutil' command-line utility or PowerShell cmdlets like 'Remove-EventLog' and 'Clear-EventLog'. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
This rule detects PowerShell commands that utilize encoded arguments such as '-enc', '-ec', or '-en'. Adversaries often use encoded PowerShell commands to obfuscate their malicious scripts, making it harder for security tools and analysts to detect and understand their activities. The rule specifically looks for the execution of 'powershell.exe' or 'powershell_ise.exe' with these encoding flags and attempts to capture and decode the obfuscated command.
Finds PowerShell execution events that could involve a download.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.
Page 139 of 160