Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
16
8
2
2
1
Contributors
8
6
4
3
2
Categories
14
7
5
4
4
Platforms
26
3
Products / Services
15
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.
Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.
Detect execution of suspicious double extension files in ParentCommandLine
Detect execution of suspicious double extension files in ParentCommandLine
'Dev-0530 actors are known to encrypt the contents of the victims device as well as renaming the file extensions. This query looks for the creation of files with .h0lyenc extension or presence of ransom note.'
Sample query that search for .settingcontent-ms that has been downloaded from the web.
Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.
Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com.
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects the execution of suspicious files that use a double extension in their name, specifically when these files appear in the ParentImage or ParentCommandLine. This technique is often used by adversaries to masquerade malicious executables as benign document or script files, tricking users into executing them.
Page 2 of 2