Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
2
2
1
1
Contributors
4
1
1
Categories
3
2
2
2
1
Platforms
6
2
2
Products / Services
4
2
2
2
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the creation of scheduled tasks that invoke rundll32.exe to execute code from suspicious, user-writable, or temporary file paths. This pattern is consistent with common persistence mechanisms employed by threat groups such as Wizard Spider (also known as Grim Spider, Gold Blackburn, and Periwinkle Tempest) to execute payloads like TrickBot or BazarLoader.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects the transfer of executable or script files to remote administrative shares (ADMIN$, C$, IPC$) between hosts, a behavior frequently observed in SystemBC staging operations and lateral movement activities associated with ransomware actors.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
The following analytic identifies the execution of `adfind.exe` with specific command-line arguments related to Active Directory queries. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant because `adfind.exe` is a powerful tool often used by threat actors like Wizard Spider and FIN6 to gather sensitive AD information. If confirmed malicious, this activity could allow attackers to map the AD environment, facilitating further attacks such as privilege escalation or lateral movement.
