Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
327 detections
Filters
Last updated
All Time
Detection languages
116
113
37
21
15
Contributors
58
49
41
33
23
Categories
236
224
38
28
19
Platforms
275
47
7
5
4
Products / Services
86
67
63
27
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
6
6
2
2
2
IDS Classtypes
2
1
1
1
IDS Protocols
3
1
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
This query was originally published in the threat analytics report, Operation Soft Cell.
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
This rule detects attempts to discover local user accounts and system owner/user information using various Windows command-line utilities. It specifically looks for the execution of `cmd.exe` with `dir \users\` (excluding `rmdir`), `net.exe` or `net1.exe` with `user` (excluding common account management actions), `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with `useraccount get`, and `cmdkey.exe` with `/l`. These commands are frequently used by adversaries to gain situational awareness about the system's users.
Detects remote RPC calls made by SharpHound, a BloodHound data collector, to enumerate remote connections and local group memberships. This specific rule targets the MS-SRVS protocol (Server Service Remote Protocol) interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188 and operation number 12, which is associated with session enumeration.
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
This rule detects the use of PowerShell to enumerate successful logon events (Event ID 4624) from the security event log on a Windows host. It specifically looks for command-line executions containing 'Get-EventLog', 'security', and '-instanceid 4624'. This activity is often performed during the reconnaissance phase by adversaries to understand user activity on a system.
Whoami Command Execution
YARA-L
Detects the execution of the 'whoami' command, which is frequently used by attackers post-exploitation to identify the current user's credentials and privileges. This activity is a common step in reconnaissance and privilege escalation phases of an attack.
Local Accounts Discovery
YARA-L
Local accounts, System Owner/User discovery using operating systems utilities
Detects the use of powershell to enumerate successful logins on a specific host
Detects the execution of the 'esxcli' command with the 'system' flag, combined with 'get' or 'list' subcommands, to retrieve information about various system components on an ESXi host. This can include details about accounts, modules, NTP settings, and other system configurations.
Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Whoami Execution
YARA-L
Detects the execution of whoami, which is often used by attackers after exploitation to establish what credentials they are logged in under
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.
Page 13 of 16