Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
KQL Query
KQL Query
KQL Query from file: Hunting IngressNightmare (CVSS 9.8)
KQL Query from file: CVE-2025-22224 (CVSS 9.3 CRITICAL) Internet facing VMware server discovery
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
KQL Query
KQL Query from file: PowerShell Self-Pwn
KQL Query
KQL Query
KQL Query from file: Hunting CVE-2025-31324
KQL Query
KQL Query from file: Critical Vulnerability in Elastic Kibana
This query identifies common processes run by ransomware
malware to destroy volume shadow copies or clean free
space on a drive to prevent a file from being recovered
post-encryption. To reduce false positives, results are
filtered to only actions taken when the initiating
process was launched from a suspicious directory. If
you don't mind false positives, consider removing the
last where clause.
Special thanks to Captain for additional inputs
malware to destroy volume shadow copies or clean free
space on a drive to prevent a file from being recovered
post-encryption. To reduce false positives, results are
filtered to only actions taken when the initiating
process was launched from a suspicious directory. If
you don't mind false positives, consider removing the
last where clause.
Special thanks to Captain for additional inputs
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During the earliest stages of a Ryuk infection, an operator downloads Cobalt Strike, a penetration testing kit that is also used by malicious actors. Cobalt Strike is used by Ryuk operators to explore the network before deploying the Ryuk payload. This malicious behavior is often obscured by Base64 encoding and other tricks.
The following query detects possible invocation of Cobalt Strike using Windows Management Instrumentation (WMI).
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.cobaltstrike.com/
https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During the earliest stages of a Ryuk infection, an operator downloads Cobalt Strike, a penetration testing kit that is also used by malicious actors. Cobalt Strike is used by Ryuk operators to explore the network before deploying the Ryuk payload. This malicious behavior is often obscured by Base64 encoding and other tricks.
The following query detects possible invocation of Cobalt Strike using Windows Management Instrumentation (WMI).
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.cobaltstrike.com/
https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page
Background Intelligent Transfer Service (BITS) is a way to reliably download files from webservers or SMB servers.
This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader.
Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This
query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer
directionality.
This service is commonly used for legitimate purposes, but can also be used as part of a malware downloader.
Additionally, bitsadmin can be used to upload files and therefore can be used for data exfiltration. This
query will identify use of bitsadmin.exe for either purpose and will identify directionality file transfer
directionality.
This query looks for identity add through exchange PowerShell
This query looks for persistence or priviledge escalation done using Windows Accessibility features.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
This query was originally published by PWC Security Research Team.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
Attackers can use Adfind which is administrative tool to gather information about Domain controllers, ADFS Servers. They may also rename executables with other benign tools on the system.
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.
Page 78 of 84