Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
7
2
Contributors
7
2
Categories
5
2
2
2
1
Platforms
6
3
Products / Services
3
3
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects the creation of specific registry keys under 'Software\AppDataLow\Software\Microsoft\' that are known to be associated with Ursnif malware. The rule filters out common legitimate registry paths used by Internet Explorer, RepService, IME, and Edge to reduce false positives.
This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain management data and perform administrative tasks on remote devices. However, attackers can also use WMI to gather information about a target or hijack control of a device. The MITRE ATT&CK framework includes WMI among its list of common enterprise attack techniques.
The following query detects when Microsoft Office software spawns an instance of the WMI command-line utility, wmic.exe.
References:
https://docs.microsoft.com/windows/win32/wmisdk/about-wmi
https://attack.mitre.org/techniques/T1047/
Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain management data and perform administrative tasks on remote devices. However, attackers can also use WMI to gather information about a target or hijack control of a device. The MITRE ATT&CK framework includes WMI among its list of common enterprise attack techniques.
The following query detects when Microsoft Office software spawns an instance of the WMI command-line utility, wmic.exe.
References:
https://docs.microsoft.com/windows/win32/wmisdk/about-wmi
https://attack.mitre.org/techniques/T1047/
Detects the download of Ursnif malware based on specific URL patterns and a successful HTTP status code. The rule looks for URIs containing a forward slash, '.php?l=', and ending with '.cab', combined with an HTTP status code of 200, indicating a successful download.
Detects Ursnif C2 traffic by identifying specific URL patterns in proxy logs. The rule looks for URIs containing base64-like encoding indicators ('_2f', '_2b') in combination with specific file extensions and directory names ('.avi' and '/images/'). This combination is indicative of Ursnif malware's command and control communication.
Detects the redirection of discovery command output by the Ursnif malware. Specifically, it looks for `cmd.exe` processes spawned by `explorer.exe` that execute a command with `/C ` and redirect its output to a `.bin` file in the `AppData\local\temp\` directory.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
Detects the execution of the "driverquery" utility, which can be used by adversaries to perform reconnaissance on installed drivers. This rule specifically looks for 'driverquery.exe' or 'drvqry.exe' as the image or original filename.
This rule detects the execution of 'driverquery.exe' or 'drvqry.exe' when initiated by specific parent processes or from suspicious directories. The parent processes include scripting engines like cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Additionally, the rule flags execution where the parent process image path contains common temporary or user-writable directories such as 'AppData\Local\', 'Users\Public\', or 'Windows\Temp\'. This combination aims to identify reconnaissance activity where an attacker is attempting to enumerate installed drivers on a system, potentially as part of a larger compromise, often associated with malware like Ursnif.