Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
7
5
1
1
Contributors
3
2
2
1
1
Categories
4
4
4
3
3
Platforms
13
1
Products / Services
5
2
2
1
1
MITRE Techniques
18,110
15,622
12,575
8,387
6,208
IDS Classtypes
1
IDS Protocols
1
This rule detects the suspicious initialization of the Common Language Runtime (CLR) components (mscoree.dll, clr.dll, or oleaut32.dll) within the explorer.exe process, followed closely by an outbound HTTPS connection to filen.io domains. This pattern is indicative of fileless .NET-based C2 implants, such as those generated by the Covenant framework, executing within the context of a legitimate Windows shell process.
This rule detects the suspicious initialization of the Common Language Runtime (CLR) components (mscoree.dll, clr.dll, or oleaut32.dll) within the explorer.exe process, followed closely by an outbound HTTPS connection to filen.io domains. This pattern is indicative of fileless .NET-based C2 implants, such as those generated by the Covenant framework, executing within the context of a legitimate Windows shell process.
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes.
Detects network connections to gateway, ingest, or egest subdomains of Filen.io, utilized by PRISMEX Covenant Grunts for C2.
Detects download of known offensive security and post-exploitation tools
Detects download of known offensive security tools for capability acquisition
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Detects outbound network traffic to Filen domains from non-browser and non-Filen client processes, which could indicate C2 communication by Sednit's modified Covenant implant.
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes. This rule specifically looks for the MD5 hashes of these stager modules in file event logs.
C2-NamedPipe
KQL
Detects the creation of a named pipe used by known APT malware.
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
This rule detects various network enumeration commands commonly used by adversaries for reconnaissance, as identified in the CISA Living off the Land report. It specifically looks for commands like 'arp -a', 'curl www.ip-api.com', 'dnscmd /enumrecords', 'dnscmd /enumzones', 'ipconfig /all', 'netsh' commands related to firewall and portproxy, and 'netstat -ano'. Additionally, it detects DNS queries for 'www.ip-api.com', which can be indicative of C2 frameworks like Covenant attempting to check for internet connectivity or external IP addresses.
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.