Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
7
5
2
1
Contributors
7
3
1
1
1
Categories
5
3
3
3
2
Platforms
15
1
Products / Services
7
6
5
4
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This detection leverages the Endpoint.Filesystem datamodel to monitor file creation events in the specified directory. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
Detects registry modifications to CLSID InprocServer32 keys where the referenced DLL path resides in a non-standard, user-writable directory (e.g., AppData, Temp, ProgramData, Public, Recycle.Bin). This technique, known as COM Hijacking (T1546.015), is used by the Turla (also known as Snake, Secret Blizzard, Uroburos) threat group to achieve persistence by redirecting legitimate COM object references to malicious payloads.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
This analytic detects the creation of URL shortcut files (.url) outside of common, legitimate directories. Such activity is often associated with malware, including ransomware like CHAOS. Malicious .url files can be used to trick users into visiting harmful websites or, if placed in specific locations (e.g., Windows Startup folder), can achieve persistence and execute malicious code upon system reboot, leading to system compromise and data loss.
The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
The analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles.
The following analytic detects the use of choice.exe in batch files as a delay tactic, a technique observed in SnakeKeylogger malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential time-based evasion techniques used by malware to avoid detection. If confirmed malicious, this behavior could allow attackers to execute code stealthily, delete malicious files, and persist on compromised hosts, making it crucial for SOC analysts to investigate promptly.
KQL Query from file: Hunting New Variant of Snake Keylogger
C2-NamedPipe
KQL
Detects the creation of a named pipe used by known APT malware.
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.
The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. Monitoring this activity is crucial as netsh.exe can be used by adversaries to bypass firewall rules or discover firewall settings. If confirmed malicious, this activity could allow attackers to manipulate firewall configurations, potentially leading to unauthorized network access or data exfiltration.
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
This rule detects the Ouroboros ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
