Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
20
15
9
2
1
Contributors
13
8
8
7
4
Categories
15
11
10
8
7
Platforms
40
8
4
2
2
Products / Services
14
10
7
5
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects Azure AD / M365 audit log events associated with OAuth2 permission grants or application consent
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
Detects the creation of Windows Management Instrumentation (WMI) Event Filter, Event Consumer, or FilterToConsumerBinding objects. Attackers use these objects to create event subscriptions that trigger malicious code or scripts upon specific system events, providing a stealthy and persistent execution mechanism.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects patterns associated with the APT29 Wineloader backdoor. It looks for the creation of ActiveX objects for Wscript.Shell and Scripting.FileSystemObject, XMLHttpRequest for HTTP requests, specific `certutil -decode` commands, `tar -xf` commands, the presence of `SqlDumper.exe` in a specific path, and generic URL patterns. These indicators suggest potential execution of malicious scripts, file manipulation, data exfiltration, and command and control communication.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
Detects suspicious VBScript execution patterns, specifically looking for a combination of keywords often used by UNC2452 (NOBELIUM) in their malware. The rule identifies command lines containing 'Execute', 'CreateObject', 'RegRead', 'window.close', and '\Microsoft\Windows\CurrentVersion', while filtering out common legitimate uses involving the 'Run' registry key path to reduce false positives.
This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.
Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.
Detects VBScript content stored into registry keys, specifically targeting the 'Software\Microsoft\Windows\CurrentVersion' path, which is often used for persistence. The rule looks for keywords indicative of VBScript or JScript execution, such as 'vbscript:', 'jscript:', 'mshtml,', 'RunHTMLApplication', 'Execute(', 'CreateObject', and 'window.close'. It explicitly filters out legitimate MSIEXEC activity related to .NET installations in specific registry paths to reduce false positives. This activity has been observed in campaigns by groups like UNC2452.
This analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It identifies successful "Set domain authentication" operations in Azure AD AuditLogs. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.
The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
Detects potential abuse of LOLBAS techniques (e.g., WerFaultSecure.exe, rundll32.exe, comsvcs.dll) associated with EDR-Freeze attacks. These attacks suspend EDR or AV processes by exploiting Windows Error Reporting to create a race condition, leaving the system unmonitored.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
Page 1 of 3