Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
4
Contributors
3
1
Categories
3
3
3
1
1
Platforms
3
3
Products / Services
3
3
3
3
2
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects the execution of an HTA file (via mshta.exe) that spawns a command prompt to silently download and execute a remote payload using curl. This behavior is consistent with the Epsilon Red ransomware campaign that uses malicious HTA files with embedded JScript to run shell commands.
'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths.
This detecton will alert when over 20 sequences are observed in a single day.'
This detecton will alert when over 20 sequences are observed in a single day.'
'This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machine within the network using that IP address. Alerts indicate that the IP address of a machine within your network was seen with it's IP address base64 encoded in an outbound web request. This method of egressing the IP was seen used in POLONIUM's RunningRAT tool, however the detection is generic.'
'This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table.
This technique was seen usee by POLONIUM in their RunningRAT tool.'
This technique was seen usee by POLONIUM in their RunningRAT tool.'