Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
Local accounts, System Owner/User discovery using operating systems utilities
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Run Whoami as SYSTEM
Sigma
Detects a whoami.exe executed by LOCAL SYSTEM. This may be a sign of a successful local privilege escalation.
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Detects the execution of whoami, which is often used by attackers after exploitation / privilege escalation
Use this query to find reconnaissance and beaconing activities after code injection occurs.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Detects certain command line parameters often used during reconnaissance activity via web shells
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
This query was originally published in the threat analytics report, MailSniper Exchange attack tool.
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
Local accounts, System Owner/User discovery using operating systems utilities
WhoAmI as Parameter
Sigma
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Detects the use of PowerShell to identify the current logged user.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_bear_activity_gtr19.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects potential Dridex acitvity via specific process patterns
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
Page 11 of 16