Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Contributors
7
4
Categories
5
3
2
2
2
Platforms
10
1
Products / Services
4
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
Detects the creation of files with double extensions, a common technique used by malware to masquerade as benign files, especially when Windows is configured to hide known file extensions. This rule specifically looks for files ending with common executable or archive extensions (like .exe, .iso, .rar, .zip, .svg) preceded by another common file extension (like .doc, .pdf, .jpg, .png, etc.).
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
Check if file hashes published in the recent abuse.ch feed are found in your mail flow scanned by Office 365 ATP.
The "Stolen Images" Bazarloader campaign uses fake copyright infingement contact form emails and malicious files pretending to contain "stolen images" to trick users into downloading the malware.
The pw protected zip attachment -> Word doc delivery method of Bazarloader utilizes Word to create an .hta file and launch it via MSHTA to connect to a malicious domain and pull down the Bazarloader paylaod.
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file.
During the chain of events from Bazacall to Bazaloader, RunDLL makes several network connections, including to command and control (C2) infrastructure. The command line for these connections contains a specific process paramter, ",GlobalOut" that can surface potentially malicious activity related to Bazacall and Bazaloader.
Detects potential installation or installation attempts of known malicious AppX packages by monitoring Windows AppXDeployment-Server Event IDs 400 and 401, specifically looking for a known malicious package full name.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.