Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
4
4
1
Contributors
3
2
2
1
1
Categories
3
2
2
2
1
Platforms
7
2
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects various indicators of Microsoft Connection Manager Profile Installer execution
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query
Detects various indicators of Microsoft Connection Manager Profile Installer execution
Identify accounts that have logged on to affected endpoints.
Check for specific alerts.
Check for specific alerts.
This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is significant as adversaries may assign privileged roles to compromised accounts to maintain persistence within the Azure AD environment. If confirmed malicious, this could allow attackers to escalate privileges, access sensitive information, and maintain long-term control over the Azure AD infrastructure.
Detects the execution of a process where the original description is 'Java Update Scheduler' or 'Java(TM) Update Scheduler', but the executable file name is not 'jusched.exe'. This behavior is indicative of an adversary renaming a legitimate utility to evade detection, a technique known to be used by groups like Cobalt Group.
Detects process access events where the call trace contains 'cmlua.dll', which is indicative of Microsoft Connection Manager Profile Installer (CMSTP) execution. This activity can be abused by adversaries for code execution and UAC bypass.