Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
2
2
Categories
1
1
1
1
1
Platforms
4
Products / Services
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
This query provides the commonality of operating systems seen in the inventory
The analytic detects suspicious remote thread execution in specific processes like Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware. It leverages Sysmon EventCode 8 to identify remote thread creation. This activity often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution, privilege escalation, or persistence on the compromised host.
The following analytic detects the creation or modification of Windows Scheduled Tasks related to CompMgmtLauncher or Eventvwr. These legitimate system utilities, used for launching the Computer Management Console and Event Viewer, can be abused by attackers to execute malicious payloads under the guise of normal system processes. By leveraging these tasks, adversaries can establish persistence or elevate privileges without raising suspicion. This detection helps security analysts identify unusual or unauthorized scheduled tasks involving these executables, allowing for timely investigation and remediation of potential threats.