Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
2
1
1
1
1
Categories
2
2
2
2
1
Platforms
4
2
1
1
Products / Services
4
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects executables with digital signatures that fail trust validation while claiming to be from well-known vendors, consistent with Dolphin X's 'Fake Code Signature' mechanism. This technique attempts to evade defenses by masquerading as a trusted application.
Detects the execution of suspicious files that exhibit characteristics of finance-themed malware droppers. This includes files with known malicious MD5 hashes, specific internal file metadata (original filename, file description, product name), or filenames masquerading as financial documents (e.g., 'GST Debit Note', 'RTGS_IMPS') with an executable extension like '.com'.
Detects files using space after extension to disguise executable files
This rule detects network traffic where a TLS certificate is presented with an issuer's common name (CN) containing at least 8 alphanumeric characters and a subject organization (O) that includes common company suffixes like 'LLC', 'Ltd', or 'Inc'. This combination, especially with an unusually formatted issuer CN, could indicate an invalid or suspicious code signing certificate used for executables, potentially associated with trojan activity or defense evasion tactics.
Detects signed executable files with untrusted certificates (expired, revoked,
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
KQL Query from file: Detecting BYOVDLL Abuse
The following query surface network activity associated with exploitation of CVE-2022-22965.
