Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
224 detections
Filters
Last updated
All Time
Detection languages
102
43
27
17
17
Contributors
65
29
21
20
12
Categories
124
120
35
28
20
Platforms
177
40
22
5
5
Products / Services
47
36
24
14
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
1
1
1
IDS Protocols
2
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Detects the execution of common reconnaissance commands (ipconfig, net, netstat, ping, systeminfo, tasklist, whoami) where the output is piped to `findstr.exe`. This technique is often used by attackers during the reconnaissance phase to extract specific information.
Detects VenomRAT, a variant of QuasarRAT, used by the RevengeHotels group in recent campaigns targeting the hospitality industry. This rule identifies the RAT based on a characteristic list of security and analysis tools it attempts to terminate, along with other unique features.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
The following analytic identifies suspicious WMI command lines querying for running processes or services. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process and command-line events. This activity is significant as adversaries often use WMI to gather system information and identify services on compromised machines. If confirmed malicious, this behavior could allow attackers to map out the system, identify critical services, and plan further attacks, potentially leading to privilege escalation or persistence within the environment.
Detects the PipeMagic backdoor, a modular framework used by Storm-2460. The rule identifies specific hardcoded keys, configuration artifacts, and strings related to its C2 communication and module management.
Detects the execution of suspicious commands commonly used for reconnaissance or networking, where the parent process command indicates it was triggered by an npm 'postinstall' script. This behavior is associated with the XORIndex loader used in the "Contagious Interview" campaign.
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query from file: ATP Detection for Critical Identities
Use this query to find reconnaissance and beaconing activities after code injection occurs.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time).
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
'Any Alerts that fired on any host with this same process in the range of +-1d'
Get the processes that are running on the local computer.
Page 9 of 11