Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
8
5
1
1
Contributors
7
2
2
1
1
Categories
12
8
2
2
1
Platforms
10
3
1
1
Products / Services
2
2
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with a file deletion command ('del', 'delete', or 'erase') using the '&' operator. This pattern can indicate an attempt to test network connectivity before or after performing a destructive action, often seen in malware or adversary scripts.
Scripted Ping Sweep Detection
Cortex XDR
Detects a command loop executing a ping sweep across an entire subnet and writing responsive hosts to 'alive_hosts.txt'. This activity is indicative of network reconnaissance.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to localhost (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern can indicate an attempt to test network connectivity before performing a destructive action, often seen in malware or adversary scripts.
Detects activity related to Network Discovery.
Here, one group of network commands has to match for the rule to trigger.
Here, one group of network commands has to match for the rule to trigger.
Detects potential Dtrack RAT activity by identifying specific command-line patterns associated with network discovery and system information gathering. The rule looks for the execution of 'ping' with specific arguments, 'ipconfig /all' redirecting output to a temporary file, and 'netsh interface ip show config' also redirecting output to a temporary file. These commands are commonly used by Dtrack for reconnaissance.
Detects a potentially suspicious one-liner command combining 'ping' and 'copy' within a 'cmd.exe' process. This combination is often used by malware for purposes such as network reconnaissance followed by data staging or exfiltration, or as a defense evasion technique by leveraging common system utilities in an unusual manner. The rule specifically looks for the presence of 'ping' and 'copy ' along with either the '-n' (count) or '-y' (yes to overwrite) flags in the command line.
Detects a suspicious command-line pattern often used by ransomware, where the 'ping' command is used with a delay (e.g., '-n 3') to introduce a pause, immediately followed by the 'del' command with force and quiet flags ('-f -q') to delete a file. This technique is typically employed to hide the initial infection vector or other malicious files by deleting them after execution.
KQL Query from file: M365 Copilot Chat SafeLink Monitoring
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats.
This rule detects attempts to enumerate remote systems on a macOS host using the 'arp' and 'ping' utilities. Specifically, it looks for 'arp -a' commands, which list all current ARP entries, and 'ping' commands targeting common private IP address ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) as well as localhost (127.0.0.0/8) and APIPA (169.254.0.0/16) ranges. This activity is indicative of an adversary performing network discovery to identify other systems for potential lateral movement.
Detects the execution of Certify, a tool used for Active Directory certificate abuse, by identifying its executable name, original file name, description in PE metadata, and specific command-line arguments related to certificate operations such as listing Certificate Authorities (CAs), finding vulnerable templates, requesting, and downloading certificates.
Detects the use of 'arp -a' or 'ping' commands targeting common private and loopback IP address ranges on Linux systems, which can indicate an adversary performing remote system discovery.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.