Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
27
8
5
1
Contributors
27
5
4
3
1
Categories
12
8
8
7
6
Platforms
40
1
1
Products / Services
26
13
12
6
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
KQL Query from file: PowerShell Self-Pwn
This analytic detects the execution of a PowerShell script that modifies the 'TrustedHosts' configuration via EventCode 4104. It leverages PowerShell Script Block Logging to identify commands targeting WSMan settings, specifically those altering or concatenating trusted hosts. This activity is significant as it can indicate attempts to manipulate remote connection settings, potentially allowing unauthorized remote access. If confirmed malicious, this could enable attackers to establish persistent remote connections, bypass security protocols, and gain unauthorized access to sensitive systems and data.
The following analytic detects the execution of files with multiple extensions, such as ".doc.exe" or ".pdf.exe". This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the file name contains double extensions. This activity is significant because attackers often use double extensions to disguise malicious executables as benign documents, increasing the likelihood of user execution. If confirmed malicious, this technique can lead to unauthorized code execution, potentially compromising the endpoint and allowing further malicious activities.
This rule detects the execution of common debugger tools (x32dbg, x64dbg, windbg) on Windows endpoints. While these tools have legitimate uses for software development and analysis, they are frequently abused by malware, such as PlugX and DarkGate, for malicious purposes like DLL side-loading or code injection. Detecting their presence and execution, especially in environments where they are not typically used by non-technical users, can indicate suspicious activity and potential compromise. This rule is designed to help Security Operations Centers (SOCs) identify such potentially malicious tool usage.
The following analytic identifies the unusual behavior of MSIExec spawning WinDBG. It detects this activity by analyzing endpoint telemetry data, specifically looking for instances where 'msiexec.exe' is the parent process of 'windbg.exe'. This behavior is significant as it may indicate an attempt to debug or tamper with system processes, which is uncommon in typical user activity and could signify malicious intent. If confirmed malicious, this activity could allow an attacker to manipulate or inspect running processes, potentially leading to privilege escalation or persistence within the environment.
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is often abused by post-exploitation tools like winpeas, commonly used in ransomware attacks to list stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant as it indicates potential credential harvesting, which can lead to privilege escalation and persistence. If confirmed malicious, attackers could gain unauthorized access to sensitive information and maintain control over compromised systems for further exploitation.
This analytic detects the execution of the Windows OS tool cmdkey.exe with the /delete parameter. This activity is significant because cmdkey.exe can be used by attackers to delete stored credentials, potentially leading to privilege escalation and persistence. If confirmed malicious, this behavior could allow attackers to remove stored user credentials, hindering incident response efforts and enabling further unauthorized access to the compromised system.
The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is used to create stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because cmdkey.exe is often abused by post-exploitation tools and malware, such as Darkgate, to gain unauthorized access. If confirmed malicious, this behavior could allow attackers to escalate privileges and maintain persistence on the targeted host, facilitating further attacks and potential data breaches.
The following analytic detects modifications to the Windows registry that disable security settings for Terminal Services. It leverages the Endpoint data model, specifically monitoring changes to the registry path associated with Terminal Services security settings. This activity is significant because altering these settings can weaken the security posture of Remote Desktop Services, potentially allowing unauthorized remote access. If confirmed malicious, such modifications could enable attackers to gain persistent remote access to the system, facilitating further exploitation and data exfiltration.
The following analytic detects modifications to the Windows registry key "AuthenticationLevelOverride" within the Terminal Server Client settings. It leverages data from the Endpoint.Registry datamodel to identify changes where the registry value is set to 0x00000000. This activity is significant as it may indicate an attempt to override authentication levels for remote connections, a tactic used by DarkGate malware for malicious installations. If confirmed malicious, this could allow attackers to gain unauthorized remote access, potentially leading to data exfiltration or further system compromise.
The following analytic detects modifications to the Windows registry key "DisableRemoteDesktopAntiAlias" with a value set to 0x00000001. This activity is significant as it may indicate the presence of DarkGate malware, which alters this registry setting to enhance its remote desktop capabilities. If confirmed malicious, this modification could allow an attacker to maintain persistence and control over the compromised host, potentially leading to further exploitation and data exfiltration.
The following analytic detects modifications to the Windows registry key "ProxyEnable" to enable proxy settings. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Internet Settings\ProxyEnable" registry path. This activity is significant as it is commonly exploited by malware and adversaries to establish proxy communication, potentially connecting to malicious Command and Control (C2) servers. If confirmed malicious, this could allow attackers to redirect network traffic through a proxy, facilitating unauthorized communication and data exfiltration, thereby compromising the security of the affected host.
This analytic detects modifications to the Windows registry key responsible for setting up a proxy server. It specifically looks for changes to the "Internet Settings\\ProxyServer" registry path. Such modifications can indicate that malware or an adversary is configuring a proxy to establish unauthorized communication channels, potentially for Command and Control (C2) or data exfiltration. The rule leverages Sysmon EventID 13 data, which records registry value set operations.
The following analytic identifies instances of the WinDBG process spawning AutoIt3. This behavior is detected by monitoring endpoint telemetry for processes where 'windbg.exe' is the parent process and 'autoit3.exe' or similar is the child process. This activity is significant because AutoIt3 is frequently used by threat actors for scripting malicious automation, potentially indicating an ongoing attack. If confirmed malicious, this could allow attackers to automate tasks, execute arbitrary code, and further compromise the system, leading to data exfiltration or additional malware deployment.
The analytic detects modifications to the Windows Error Reporting registry key "DontShowUI" to suppress error reporting dialogs. It identifies changes where the registry value is set to 0x00000001. This activity is significant as it is commonly associated with DarkGate malware, which uses this modification to avoid detection during its installation. If confirmed malicious, this behavior could allow attackers to maintain a low profile, avoiding user alerts and potentially enabling further malicious activities without user intervention.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
Detects the creation of a local user account named "DarkGate" with the username "SafeMode" using the `net.exe` or `net1.exe` command-line utility. This specific pattern is associated with DarkGate malware activity.
Detects tampering of RDP Terminal Service/Server sensitive settings. This includes modifications to allow unsolicited remote assistance, disable security settings, or enable RDP via specific registry keys. It also covers changes related to RDP hijacking via the 'ServiceDll' key and the 'Shadow' RDP technique.
Page 2 of 2