Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
4
2
1
Categories
4
2
1
1
1
Platforms
7
Products / Services
4
3
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
The following analytic detects the execution of gpupdate.exe without any command line arguments. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. It is significant because gpupdate.exe typically runs with specific arguments, and its execution without them is often associated with malicious activities, such as those performed by Cobalt Strike. If confirmed malicious, this activity could indicate an attempt to execute unauthorized commands or scripts, potentially leading to further system compromise or lateral movement within the network.
The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
The following analytic detects instances of DLLHost.exe running without command line arguments while establishing a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network activity data. It is significant because DLLHost.exe typically runs with specific arguments, and its absence can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to execute code, move laterally, or exfiltrate data, posing a severe threat to the network's security.
This rule detects modifications to specific Windows Registry keys that are known to be used by BlackByte ransomware for privilege escalation and to prepare for lateral movement and encryption. Specifically, it looks for the setting of 'LocalAccountTokenFilterPolicy', 'EnableLinkedConnections', and 'LongPathsEnabled' to a DWORD value of '1'. These modifications can enable administrative shares for non-administrator accounts, allow for longer file paths, and potentially facilitate ransomware operations.
The following analytic detects a modification to the Windows registry setting "LongPathsEnabled," which allows file paths longer than 260 characters. This detection leverages data from the Endpoint.Registry datamodel, focusing on changes to the specific registry path and value. This activity is significant because adversaries, including malware like BlackByte, exploit this setting to bypass file path limitations, potentially aiding in evasion techniques. If confirmed malicious, this modification could facilitate the execution of long-path payloads, aiding in persistence and further system compromise.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
Detects the creation of scheduled tasks using `schtasks.exe` that are configured to run once at exactly 00:00 and execute suspicious commands or scripts. The suspicious commands include common scripting engines (wscript, cscript, powershell), WMI, regsvr32, or executables located in the AppData directory. This pattern is often used by adversaries for persistence or execution at a specific, often stealthy, time.