Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
36
16
14
7
1
Contributors
36
14
13
9
1
Categories
32
26
10
9
8
Platforms
64
8
1
Products / Services
34
27
24
13
8
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
IDS Classtypes
4
3
IDS Protocols
5
2
Detects HTTP traffic patterns characteristic of Qakbot (QBot) malware command-and-control (C2) communication. This rule monitors for POST requests to .php files featuring a specific hardcoded User-Agent (IE 7.0 on Windows NT 5.1), a 'Cookie' header, 'application/octet-stream' content type, and a request body length of at least 201 characters.
The following analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process relationships and command-line executions. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.
The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant as it often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host.
Detects HTTP POST requests characteristic of QakBot command-and-control check-ins. The rule looks for an 'established' flow to an external network using a POST method, with a request body containing 'qbot' followed by a version string pattern, which is indicative of the malware reporting system info to its C2 server.
Detects outbound HTTP POST requests characteristic of QakBot malware command and control (C2) activity. The rule identifies a specific combination of a hardcoded User-Agent string ('Trident/7.0') and a URI pattern consisting of 4 to 32 alphanumeric characters ending in .php.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects outbound HTTP POST requests characteristic of QakBot malware command and control (C2) activity. The rule identifies a specific combination of a hardcoded User-Agent string ('Trident/7.0') and a URI pattern consisting of 4 to 32 alphanumeric characters ending in .php.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Detects HTTP POST requests characteristic of QakBot command-and-control check-ins. The rule looks for an 'established' flow to an external network using a POST method, with a request body containing 'qbot' followed by a version string pattern, which is indicative of the malware reporting system info to its C2 server.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.
Detects the creation or modification of a specific registry key path often used by malware families like IceID and Qakbot for persistence or defense evasion. The rule specifically looks for the registry key ending with '\Software\firm\soft\Name'. This activity has been observed in campaigns distributing malicious OneNote files.
The following analytic identifies `services.exe` spawning a LOLBAS (Living Off the Land Binaries and Scripts) execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `services.exe` is the parent process. This activity is significant because adversaries often abuse the Service Control Manager to execute malicious code via native Windows binaries, facilitating lateral movement. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe security risk.
The following analytic detects the creation of a Windows Service with a binary path located in uncommon directories, using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify services installed outside typical system directories. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment.
The following analytic identifies processes running from %temp% directory file paths. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts.
The analytic detects the use of `cmd.exe /c` or `cmd.exe /k` to execute commands. This technique is often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized command execution. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
Page 1 of 4