Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
68 detections
Filters
Last updated
All Time
Detection languages
21
20
17
8
2
Contributors
32
5
5
4
4
Categories
31
28
26
18
11
Platforms
27
26
23
10
4
Products / Services
24
16
16
14
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
KQL Query
This rule detects DNS queries to domains associated with legitimate remote access software (e.g., TeamViewer, Go2Assist, LogMeIn, AmmyyAdmin, RustDesk, Quick Assist, Remote Utilities, Tailscale, Twingate, NetSupport Manager) when those queries originate from a non-browser application. Adversaries often leverage these legitimate tools to establish command and control (C2) channels or maintain persistence on compromised systems, as they may be allowed by application control policies. The rule includes extensive filters to exclude common web browsers and other legitimate system processes that might legitimately query these domains, aiming to reduce false positives.
Detects the execution of a specific binary identified by its filename and SHA256 hash. This binary is associated with the Lace Tempest threat group and is used to load additional malware, as reported by the SysAid Team. The detection specifically looks for a process created from the path ':\Program Files\SysAidServer\tomcat\webapps\usersfiles\user.exe' or a process with the SHA256 hash 'B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D'.
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team. The script specifically targets files related to 'usersfiles.war' and 'SysAidServer' within a Tomcat directory, indicating an attempt to clean up traces of an intrusion or exploit.
Detects a PowerShell script used by the Lace Tempest APT group to launch their malware loader by exploiting CVE-2023-47246. The script contains specific strings related to the SysAid server path, the execution of 'user.exe', and the removal of temporary files.
Page 4 of 4