Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.
Baseline Comparison.
Author: miflower.
The purpose of this query is to perform a comparison between "known good" machines and suspected bad machines.
The original concept for this query was born due to reapplying the same 'whitelist' filters over and over.
It brings deltas between a baseline and another machine quickly to the analyst's view.
This query supports multiple suspected bad machines and multiple "known good" machines.
It also supports providing a timeframe for how far back in time to build a baseline as well as how far back in time to evaluate the suspected bad machines.
Each of the links provided by DeviceId/DeviceName will go to the most recent entry for whatever entity is listed.
Average results for the pre-defined settings below with a single good host and a single bad host on a 'huge' tenant (300k+ machines):.
Compute Time: ~10-20 seconds.
Result Set Size: ~500 rows.
The workflow is as follows:.
1. Establish Variables that are editable on a per-query basis.
2. Define functions for reuse.
3. Calculate DeviceIds for all machines in scope.
4. Derive deltas using the aforementioned functions.
5. Union together all results into a single view.
The following datasets are returned:.
1. Alerts on the suspected bad machines (ignores known good machines, because...they're alerts, additional data has the triggered file).
2. Connected Networks (from DeviceNetworkInfo table, additional data has full Connected Network details).
3. File Creations (disabled by default due to volume, enable at your own risk, additional data has initiating processes).
4. Image Loads (disabled by default due to volume, enable at your own risk, additional data has initiating processes).
5. Logon (derived from DeviceLogonEvents for the unique users logged on, additional data has logon types).
6. Network communication (grouped by 2nd level-domain, ie 'microsoft.com' in 'www.microsoft.com' and 'web.microsoft.com', additional data has the full list of URLs).
7. Process creation (additional da
Author: miflower.
The purpose of this query is to perform a comparison between "known good" machines and suspected bad machines.
The original concept for this query was born due to reapplying the same 'whitelist' filters over and over.
It brings deltas between a baseline and another machine quickly to the analyst's view.
This query supports multiple suspected bad machines and multiple "known good" machines.
It also supports providing a timeframe for how far back in time to build a baseline as well as how far back in time to evaluate the suspected bad machines.
Each of the links provided by DeviceId/DeviceName will go to the most recent entry for whatever entity is listed.
Average results for the pre-defined settings below with a single good host and a single bad host on a 'huge' tenant (300k+ machines):.
Compute Time: ~10-20 seconds.
Result Set Size: ~500 rows.
The workflow is as follows:.
1. Establish Variables that are editable on a per-query basis.
2. Define functions for reuse.
3. Calculate DeviceIds for all machines in scope.
4. Derive deltas using the aforementioned functions.
5. Union together all results into a single view.
The following datasets are returned:.
1. Alerts on the suspected bad machines (ignores known good machines, because...they're alerts, additional data has the triggered file).
2. Connected Networks (from DeviceNetworkInfo table, additional data has full Connected Network details).
3. File Creations (disabled by default due to volume, enable at your own risk, additional data has initiating processes).
4. Image Loads (disabled by default due to volume, enable at your own risk, additional data has initiating processes).
5. Logon (derived from DeviceLogonEvents for the unique users logged on, additional data has logon types).
6. Network communication (grouped by 2nd level-domain, ie 'microsoft.com' in 'www.microsoft.com' and 'web.microsoft.com', additional data has the full list of URLs).
7. Process creation (additional da
Detects modification of autostart extensibility point (ASEP) in registry.
Detects registry key used by Leviathan APT in Malaysian focused campaign
Detects the use of Windows Credential Editor (WCE)
Looks for suspicious base64 encoded registry keys being created.
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Author: Jouni Mikkola
References:
https://threathunt.blog/registry-hunts/
Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)
Detects Processes accessing the camera and microphone from suspicious folder
Detects abusing Windows 10 Narrator's Feedback-Hub
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll
'Identifies attempts to modify registry ACL to evade security solutions. In the Solorigate attack, the attackers were found modifying registry permissions so services.exe cannot access the relevant registry keys to start the service.
The detection leverages Security Event as well as MDE data to identify when specific security services registry permissions are modified.
Only some portions of this detection are related to Solorigate, it also includes coverage for some common tools that perform this activity.
Reference on guidance for enabling registry auditing:
- https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing-faq
- https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events
- https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-registry
- https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670
- For the event 4670 to be created the audit policy for the registry must have auditing enabled for Write DAC and/or Write Owner
- https://github.com/OTRF/Set-AuditRule
- https://docs.microsoft.com/dotnet/api/system.security.accesscontrol.registryrights?view=dotnet-plat-ext-5.0'
The detection leverages Security Event as well as MDE data to identify when specific security services registry permissions are modified.
Only some portions of this detection are related to Solorigate, it also includes coverage for some common tools that perform this activity.
Reference on guidance for enabling registry auditing:
- https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing-faq
- https://docs.microsoft.com/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events
- https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-registry
- https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670
- For the event 4670 to be created the audit policy for the registry must have auditing enabled for Write DAC and/or Write Owner
- https://github.com/OTRF/Set-AuditRule
- https://docs.microsoft.com/dotnet/api/system.security.accesscontrol.registryrights?view=dotnet-plat-ext-5.0'
Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
This query looks for persistence or priviledge escalation done using Windows Accessibility features.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
It covers some of the techniques that could be used to utilize these features for malicious purposes,.
Including attaching a debugger using a registry config or overwriting these files.
Note: some developers might use such hacks for all sort of troubleshooting and testing purposes,.
But this better be prohibited, as it allows any account with access to the machine to run processes as SYSTEM.
Read more here: https://attack.mitre.org/wiki/Technique/T1015.
Tags: #AccessibilityFeatures, #StickyKeys, #ImageFileExecutionOptions, #Debugger, #PriviledgeEscalation, #Persistence.
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
Alerts on trust record modification within the registry, indicating usage of macros
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Page 45 of 53