Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
7
7
4
1
Contributors
7
5
4
2
1
Categories
7
7
6
5
3
Platforms
18
Products / Services
11
8
8
5
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
1
1
1
Detects the creation of a 'WSPrint' scheduled task followed by deletion of its Security Descriptor (SD) registry value. Deleting the SD value hides the task from schtasks /query and Task Scheduler. This technique is used by UAT-9244 for stealthy persistence and is also associated with HAFNIUM/Tarrask.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
This analytic identifies instances where a shell (PowerShell.exe or Cmd.exe) is spawned from W3WP.exe, the IIS worker process. This activity is significant as it may indicate webshell activity, often associated with exploitation attempts like those by the HAFNIUM Group on Exchange servers. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This analytic identifies the creation of suspicious .aspx or .ashx files in known drop locations for Exchange exploitation. Specifically, it targets paths associated with HAFNIUM group activity and vulnerabilities like ProxyShell and ProxyNotShell. This activity is a strong indicator of web shell deployment, a common method for persistent access and remote code execution. Successful exploitation could lead to unauthorized access, arbitrary command execution, and privilege escalation within the Exchange environment.
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
'This query looks for suspicious request patterns to Exchange servers that fit a pattern observed by Silk Typhoon actors.
The same query can be run on HTTPProxy logs from on-premise hosted Exchange servers.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
The same query can be run on HTTPProxy logs from on-premise hosted Exchange servers.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
'This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the table http_proxy_oab_CL before using this query.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
'This query looks for errors that may indicate that an attacker is attempting to exploit a vulnerability in the service.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
'This query looks for new processes being spawned by the Exchange UM service where that process has not previously been observed before.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
The analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode 4732 (user added to Administrators group). This activity is significant as it indicates potential unauthorized privilege escalation, which is critical for SOC monitoring. If confirmed malicious, this could allow attackers to gain administrative access, leading to unauthorized data access, system modifications, and disruption of services. Immediate investigation is required to mitigate risks and prevent further unauthorized actions.
The following analytic detects the use of Ntdsutil to export the Active Directory database (NTDS.dit). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because exporting NTDS.dit can be a precursor to offline password cracking, posing a severe security risk. If confirmed malicious, an attacker could gain access to sensitive credentials, potentially leading to unauthorized access and privilege escalation within the network.
The analytic detects PowerShell commands using the WindowStyle parameter to hide the window while connecting to the Internet. This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions that include variations of the WindowStyle parameter. This activity is significant because it attempts to bypass default PowerShell execution policies and conceal its actions, which is often indicative of malicious intent. If confirmed malicious, this could allow an attacker to execute commands stealthily, potentially leading to unauthorized data exfiltration or further compromise of the endpoint.
The analytic detects the use of the Nishang Invoke-PowerShellTCPOneLine utility, which initiates a callback to a remote Command and Control (C2) server. It leverages Endpoint Detection and Response (EDR) data, focusing on PowerShell processes that include specific .NET classes like Net.Sockets.TCPClient and System.Text.ASCIIEncoding. This activity is significant as it indicates potential remote control or data exfiltration attempts by an attacker. If confirmed malicious, this could lead to unauthorized remote access, data theft, or further compromise of the affected system.
The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. It detects this activity by monitoring the MSExchangeMailboxReplication.exe process, which typically does not write .aspx files. This behavior is significant as it may indicate an active exploitation attempt on Exchange servers. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, or maintain persistence within the environment. Immediate investigation and remediation are crucial to prevent further compromise.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
This rule detects potential successful exploitation of CVE-2021-26857, a Microsoft Exchange Server vulnerability. It specifically looks for abnormal child processes spawning from the 'UMWorkerProcess.exe' (Unified Messaging service) on Exchange servers. The rule filters out legitimate Windows Error Reporting processes ('wermgr.exe' and 'WerFault.exe') to reduce false positives, indicating that any other process spawned by 'UMWorkerProcess.exe' is considered suspicious and a potential indicator of compromise.
Detects exploitation attempts targeting Microsoft Exchange servers, specifically those associated with the HAFNIUM group's activity. The rule looks for suspicious POST requests to specific URI paths and user-agent strings that were observed during the HAFNIUM attacks.