Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
2
2
1
Categories
2
1
1
1
1
Platforms
4
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects the execution of JavaScript files using wscript.exe from user-writable directories (e.g., Temp, Downloads, AppData) that exhibit high levels of obfuscation. The rule specifically flags scripts containing a high ratio of comment lines to code, a technique often used in the LausivLoader malware family to mask malicious payloads constructed using String.fromCharCode.
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
Detects NOP sled patterns in payloads indicating junk code insertion for evasion
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
'Potential code injection into web server roles via IIS logs scan. Represents attempt to gain initial access using drive-by compromise technique. Detection flags events for review and filtering of authorized activity.'