Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
20
8
1
Contributors
17
6
1
1
1
Categories
16
7
5
5
3
Platforms
28
Products / Services
16
4
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
'Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This is intended to help use process exection information to discovery any systems that have SolarWinds processes'
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
The analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.
Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.
Detects a specific PowerShell command line pattern used by the UNC2452 threat group (also known as APT29 or Nobelium) for execution. The rule looks for PowerShell commands that use 'Invoke-WMIMethod win32_process -name create -argumentlist' or 'wmic /node: process call create' in conjunction with 'rundll32 c:\windows'. This pattern was observed in the SolarWinds Compromise.
Detects attempts to exploit CVE-2020-10148, an authentication bypass vulnerability in SolarWinds Orion API. This rule looks for specific URI query patterns associated with the exploit, while excluding legitimate requests.
Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).
Page 2 of 2