Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
34
8
4
1
Contributors
34
8
4
1
Categories
16
13
6
5
5
Platforms
44
2
1
Products / Services
32
20
17
5
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects HTTP POST requests with 'photo' in the URI and Gzip-compressed body content, which is a known C2 communication pattern used by the IcedID banking trojan.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". This is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
The analytic detects a suspicious `mshta.exe` process spawning `rundll32.exe` or `regsvr32.exe` child processes. This activity is a known technique used by malware like Trickbot to load malicious DLLs and execute payloads. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or download additional malware, posing a severe threat to the environment.
This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.
This analytic detects the creation of `sqlite32.dll` or `sqlite64.dll` files within the `%temp%` directory. This activity is often associated with the IcedID malware, which utilizes sqlite3 modules to parse browser databases and exfiltrate sensitive information like banking details, credit card information, and credentials. Detection of this behavior could indicate data theft and compromise of user accounts.
Detects the deletion of a registry key responsible for the 'Scan with Defender' option in the Windows context menu. Attackers may delete this key to hinder users from easily scanning suspicious files, thereby weakening defenses.
The analytic detects the use of `cmd.exe /c` or `cmd.exe /k` to execute commands. This technique is often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized command execution. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
The following analytic detects the execution of the chcp.com utility, which is used to change the active code page of the console. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because it can indicate the presence of malware, such as IcedID, which uses this technique to determine the locale region, language, or country of the compromised host. If confirmed malicious, this could lead to further system compromise and data exfiltration.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
The analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. This activity is significant because both Red Teams and adversaries use `arp.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify active devices, and plan further lateral movement or attacks.
The analytic detects the execution of tasks registered in Windows Task Scheduler by monitoring EventID 200 (action run) and 201 (action completed) from the Task Scheduler logs. This detection leverages Task Scheduler logs to identify potentially suspicious or unauthorized task executions. Monitoring these events is significant for a SOC as it helps uncover evasive techniques used for persistence, unauthorized code execution, or other malicious activities. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or the execution of harmful payloads, posing a significant threat to the environment.
Use this query to locate emails with subject indicators of a reply or forward, and the attachment is a .doc, or a .zip containing a .doc. Review results for suspicious emails.
IcedId can lead to ransomware
IcedId can lead to ransomware
Use this query to locate emails and malicious downloads related to the IcedId activity that can lead to ransomware
Use this query to locate successful delivery of associated malicious downloads that can lead to ransomware
Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware.
The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. It leverages data from Endpoint Detection and Response (EDR) agents, specifically monitoring changes to the registry path associated with Windows Defender reporting. This activity is significant because disabling Enhanced Notifications can prevent users and administrators from receiving critical security alerts, potentially allowing malicious activities to go unnoticed. If confirmed malicious, this action could enable an attacker to bypass detection mechanisms, maintain persistence, and escalate their activities without triggering alerts.
This analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
This analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
The following analytic detects any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process and parent process relationships. This activity is significant as it is a known tactic of the IcedID malware family, which can lead to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.
The following analytic detects the modification of Windows Defender registry settings to disable antivirus and antispyware protections. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with Windows Defender policies. This activity is significant because disabling antivirus protections is a common tactic used by adversaries to evade detection and maintain persistence on compromised systems. If confirmed malicious, this action could allow attackers to execute further malicious activities undetected, leading to potential data breaches, system compromise, and further propagation of malware within the network.
Page 1 of 3