Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
2
1
1
Contributors
3
1
1
1
1
Categories
4
2
2
2
1
Platforms
6
2
Products / Services
3
2
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects the execution of a VBScript file named 'windows_api.vbs' from common public or appdata directories, a characteristic behavior of the GOGITTER malware as part of the Gopher Strike campaign.
The analytic identifies a high frequency of file deletions by monitoring Sysmon EventCodes 23 and 26 for specific file extensions. This detection leverages Sysmon logs to track deleted target filenames, process names, and process IDs. Such activity is significant as it often indicates ransomware behavior, where files are encrypted and the originals are deleted. If confirmed malicious, this activity could lead to extensive data loss and operational disruption, as ransomware can render critical files inaccessible, demanding a ransom for their recovery.
Detects a suspicious process recursively deleting or overwriting a high volume of executable files (.exe, .sys, .dll) on a Windows host, leveraging Sysmon Event IDs 23 and 26. This behavior is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer.
KQL Query from file: Fortigate Belsen Leak KQL Check
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
The following query surface network activity associated with exploitation of CVE-2022-22965.
This rule detects the CaddyWiper trojan, a destructive data wiper, by identifying specific byte patterns within executable files. The patterns correspond to functions involved in destroying data if the system is not a controller, erasing drive data, and recursively erasing drives.
