Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects a suspicious child process of userinit
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if Qakbot has injected code into the ping.exe process, to evade security and access credentials.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if Qakbot has injected code into the ping.exe process, to evade security and access credentials.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
'Identifies a match across various data feeds for named pipe IOCs related to the Solorigate incident.
For the sysmon events required for this detection, logging for Named Pipe Events needs to be configured in Sysmon config (Event ID 17 and Event ID 18)
Reference: https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095'
For the sysmon events required for this detection, logging for Named Pipe Events needs to be configured in Sysmon config (Event ID 17 and Event ID 18)
Reference: https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095'
This is a completely stupid and pointless query that makes Vogon poetry out
of a random FolderPath from the table you pass it. You can change
DeviceProcessEvents for any table as long as it has a column named DeviceName
and a column called FolderPath. Feel free to check in more verses :)
Don't know what Vogon poetry is? You have a research assignment: http://tinyurl.com/y8ueqchl
of a random FolderPath from the table you pass it. You can change
DeviceProcessEvents for any table as long as it has a column named DeviceName
and a column called FolderPath. Feel free to check in more verses :)
Don't know what Vogon poetry is? You have a research assignment: http://tinyurl.com/y8ueqchl
Dopplepaymer In-Memory Malware Implant.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This rule detects the creation of processes related to the NT Virtual DOS Machine (NTVDM), specifically `ntvdm.exe` and `csrstub.exe`. NTVDM allows 16-bit Windows applications and both 16-bit and 32-bit DOS applications to run on 32-bit Windows operating systems. While NTVDM is a legitimate Windows component, its execution might be unusual in modern environments, especially 64-bit systems where it's not natively supported, and could indicate an attempt to run legacy or potentially malicious 16-bit code.
Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.
This analytic identifies suspicious remote thread execution where the `wermgr.exe` process injects code into known browser processes such as `firefox.exe`, `chrome.exe`, `iexplore.exe`, and `microsoftedgecp.exe`. It uses Sysmon EventCode 8 logs to detect this behavior by monitoring the `SourceImage` and `TargetImage` fields. This activity is significant because it is indicative of Qakbot malware, which is known to inject malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
The analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
This analytic detects the use of `mavinject.exe` for DLL injection into running processes. It specifically looks for command-line parameters such as `/INJECTRUNNING` and `/HMODULE`. This activity indicates potential arbitrary code execution, a common tactic for malware deployment and persistence. If confirmed malicious, this could allow attackers to execute unauthorized code, escalate privileges, and maintain persistence within the environment, posing a severe security risk.
The search surfaces alerts from the Cisco AI Defense product for potential attacks against the AI models running in your environment. This analytic identifies security events within Cisco AI Defense by examining event messages, actions, and policy names. It focuses on connections and applications associated with specific guardrail entities and ruleset types. By aggregating and analyzing these elements, the search helps detect potential policy violations and security threats, enabling proactive defense measures and ensuring network integrity.
This analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. It detects command-line executions where `cmd.exe` uses `echo` to write to a named pipe, such as `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant as it indicates potential privilege escalation attempts. If confirmed malicious, attackers could gain elevated privileges, enabling further compromise and persistence within the environment.
The analytic detects instances of `regsvcs.exe` running without command line arguments. This behavior typically indicates process injection, where another process manipulates `regsvcs.exe`. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, IDs, and command-line executions. This activity is significant as it may signal an attempt to evade detection and execute malicious code. If confirmed malicious, the attacker could achieve code execution, potentially leading to privilege escalation, persistence, or access to sensitive information.
The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
The following analytic identifies instances where Notepad.exe is launched without any command line arguments, a behavior commonly associated with the SliverC2 framework. This detection leverages process creation events from Endpoint Detection and Response (EDR) agents, focusing on processes initiated by Notepad.exe within a short time frame. This activity is significant as it may indicate an attempt to inject malicious code into Notepad.exe, a known tactic for evading detection. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise and unauthorized access.
The following analytic identifies instances where explorer.exe is spawned by unusual parent processes such as cmd.exe, powershell.exe, or regsvr32.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because explorer.exe is typically initiated by userinit.exe, and deviations from this norm can indicate code injection or process masquerading attempts by malware like Qakbot. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, evade detection, and maintain persistence within the environment.
This analytic detects an unusual process execution pattern where a process running from `C:\Windows\SysWOW64\` attempts to execute a binary from `C:\Windows\System32\`. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking.
Page 53 of 55