Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects the pattern of a pipe name as used by the hack tool CoercedPotato
This query offers daily categorization of ASR rules, helping SOC analysts monitor specific categories like office-related activities or WMI among the 16 rules.
It aids in tracking detection rates and organizational trends.
It aids in tracking detection rates and organizational trends.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
Detects potential Dridex acitvity via specific process patterns
PowerShell ShellCode
Sigma
Detects Base64 encoded Shellcode
Detects potential Dridex acitvity via specific process patterns
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
Detects the use of the Dinject PowerShell cradle based on the specific flags
Detects a suspicious child process of userinit
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.
Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics
Detects the use of the Dinject PowerShell cradle based on the specific flags
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
Detects the use of CoercedPotato, a tool for privilege escalation
Page 52 of 55