Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
13
7
6
2
2
Contributors
7
5
5
4
3
Categories
15
10
5
5
4
Platforms
23
4
3
2
1
Products / Services
10
9
7
6
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
1
IDS Protocols
2
Detects the use of Windows administrative tools (vssadmin, wbadmin, and bcdedit) to delete Volume Shadow Copies, backup catalogs, and disable system recovery mechanisms. This behavior is highly indicative of preparatory stages for destructive wiper malware attacks, such as those historically observed by the Sandworm (Seashell Blizzard) group (e.g., CaddyWiper, Industroyer2).
Detects command-line indicators associated with destructive disk-wiping activity, specifically targeting disk structure corruption to render systems unbootable. This rule monitors for unauthorized use of the Windows 'diskpart' utility, direct raw physical drive access, and specific file system utility commands (fsutil) frequently observed in wipers attributed to APT44 (Sandworm).
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
Detects network traffic patterns indicative of a Netcat-based reverse shell associated with the UAT-11823 (Sandworm) threat group. The rule monitors for characteristic command output such as 'uid=' and 'gid=', shell error strings containing '/bin/sh', and root shell prompts ('root@#') following suspected exploitation of CVE-2026-20079.
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
This rule detects potential wiper activity by monitoring for high-frequency deletion or modification of specific file types (e.g., .docx, .xlsx, .pdf, .db, .bak) within a short window. It triggers when a process like PowerShell or Cmd is observed executing destructive commands (e.g., 'del', 'erase', 'Remove-Item') on a large number of files across multiple directories, which is a common behavior of malware attempting to destroy data.
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Detects the creation of a 'Realtek HD Audio Universal Service' run key pointing to a downloaded malware payload, as observed in Seedworm activity.
Detects the specific Seedworm MSI dropper 'update_ms.msi' executed via msiexec. This rule identifies process execution where 'msiexec.exe' is the process and its command line contains 'update_ms.msi', indicating the execution of a known malicious MSI file associated with the Seedworm APT group.
Detects the ZEROLOT wiper, a component reportedly used by the Sandworm group. This rule identifies specific artifacts related to its disk wiping functionality.
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Detects suspicious process execution patterns originating from AsperaFaspex, specifically targeting activities observed in campaigns attributed to Mint Sandstorm. The rule looks for PowerShell execution with suspicious command-line arguments (e.g., for credential dumping, defense evasion, or discovery), execution of tools like wget or curl for downloading content, attempts to modify local administrator groups, registry modifications for defense evasion, and WMI/vssadmin/wbadmin commands for persistence or defense evasion. This behavior indicates potential post-exploitation activity.
Detects suspicious process execution originating from ManageEngine applications, as observed in attacks attributed to Mint Sandstorm. The rule specifically looks for PowerShell, `lsass` related commands, `wget`, `curl`, script execution, local group modifications, network user additions, registry modifications for Defender or LSA, WMIC for process creation or shadow copy deletion, `vssadmin` for shadow deletion, and `wbadmin` for catalog deletion, all originating from a ManageEngine parent process. It filters out legitimate ManageEngine downloads.
Detects the execution of 'curl.exe' with command-line arguments indicating the use of SOCKS proxies (socks5h, socks5, socks4a) and targeting '.onion' domains. This combination is highly indicative of activity associated with the Kalambur backdoor, which leverages TOR for command and control.
The analytic identifies a high frequency of file deletions by monitoring Sysmon EventCodes 23 and 26 for specific file extensions. This detection leverages Sysmon logs to track deleted target filenames, process names, and process IDs. Such activity is significant as it often indicates ransomware behavior, where files are encrypted and the originals are deleted. If confirmed malicious, this activity could lead to extensive data loss and operational disruption, as ransomware can render critical files inaccessible, demanding a ransom for their recovery.
KQL Query from file: Endpoint SMB Exposed on Public Internet
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
The following analytic identifies the execution of the Windows shutdown command via the command line interface. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because attackers may use the shutdown command to erase tracks, cause disruption, or ensure changes take effect after installing backdoors. If confirmed malicious, this activity could lead to system downtime, denial of service, or evasion of security tools, impacting the overall security posture of the network.
KQL Query from file: Detecting External Microsoft Teams Spray
Page 1 of 2