Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
1
1
Contributors
4
1
1
1
Categories
6
2
1
1
1
Platforms
7
Products / Services
1
1
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
The following analytic identifies the creation or deletion of scheduled tasks using the schtasks.exe utility with the -create or -delete flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it can indicate unauthorized system manipulation or malicious intent, often associated with threat actors like Dragonfly and incidents such as the SUNBURST attack. If confirmed malicious, this activity could allow attackers to execute code, escalate privileges, or persist within the environment, posing a significant security risk.
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
Dragon Fly
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_dragonfly.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects the execution of a renamed SysInternals tool, specifically 'ps.exe', with command-line arguments '-accepteula' and '-s cmd /c netstat'. This specific combination has been observed in attacks attributed to the Dragonfly APT group and is documented in the US-CERT TA17-293A alert.
