Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
60
53
11
9
8
Contributors
33
24
20
17
15
Categories
100
100
95
12
10
Platforms
159
4
1
Products / Services
45
28
27
27
20
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
IDS Classtypes
6
IDS Protocols
6
Defrag Deactivation
Sigma
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Detects the creation of a scheduled task via file creation.
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
'The query detects a scheduled task, created/updated remotely, using the Schtasks process.
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
Threat actors are using scheduled tasks for establishing persistence and moving laterally through the network.
Ref: https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html'
'This query could identify critical user management operations like user registration(Microsoft Entra ID Multi-Factor Authentication & self-service password reset (SSPR)) authentication by admin account followed by attempts to stop System Restore activity. Stopping system restore prevents from recovering data by going back to a restore point. The operations could be an indication of attackers trying to maintain persistence, move laterally with attempts to stop system restore point that could point to a potential ransomware attack.'
This query identifies common processes run by ransomware
malware to destroy volume shadow copies or clean free
space on a drive to prevent a file from being recovered
post-encryption. To reduce false positives, results are
filtered to only actions taken when the initiating
process was launched from a suspicious directory. If
you don't mind false positives, consider removing the
last where clause.
Special thanks to Captain for additional inputs
malware to destroy volume shadow copies or clean free
space on a drive to prevent a file from being recovered
post-encryption. To reduce false positives, results are
filtered to only actions taken when the initiating
process was launched from a suspicious directory. If
you don't mind false positives, consider removing the
last where clause.
Special thanks to Captain for additional inputs
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_schtask_creation.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Detects the creation of a scheduled task via Registry keys.
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Find attempts to stop System Restore and.
Prevent the system from creating restore points.
Prevent the system from creating restore points.
Defrag Deactivation
Sigma
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
This rule detects rare scheduled task creations. Typically software gets installed on multiple systems and not only on a few. The aggregation and count function selects tasks with rare names.
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
This query was originally published in the threat analytics report, Sysrv botnet evolution.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptocurrency.
The following query finds instances of Apache Tomcat 8 being exploited to execute encoded PowerShell commands.
Page 6 of 8