Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
2
1
1
1
1
Categories
2
2
1
1
1
Platforms
3
2
1
1
Products / Services
2
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects Microsoft Office applications (winword.exe or excel.exe) spawning shell processes (cmd.exe or powershell.exe). This behavior is commonly associated with malicious VBA macro execution in weaponized Office documents used for malware delivery, such as Dridex.
Hades Decoy Anthropic Traffic
Cortex XDR
Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.
Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.
KQL Query
The query looks for users or service principals that attached an uncommon credential type to application.
As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails.
See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources.
Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails.
See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources.
Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
Detects attempts to uninstall or terminate security products using the Windows Management Instrumentation Command-line (WMIC) utility. Adversaries often disable or remove security software to evade detection and facilitate their malicious activities. This rule specifically looks for WMIC commands that target common security product names and attempt to uninstall or terminate them.