Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
3
1
1
1
Platforms
5
Products / Services
3
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. Adversaries may create this file to test AppLocker policies or to bypass them.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query provides the commonality of operating systems seen in the inventory
This rule detects when an application or file is prevented from running by AppLocker. It specifically looks for AppLocker event IDs 8004, 8007, 8022, and 8025, which indicate that an executable, script, or other file type was blocked from execution based on configured AppLocker policies. This is a critical control for preventing unauthorized software execution, especially in environments where users might attempt to run unapproved applications or scripts.
Detects when the deployment of an AppX package is blocked by an AppLocker policy. This indicates an attempt to install or run an unauthorized application package, which could be a defense evasion attempt or an attempt to introduce malicious software.