Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,463 detections
Filters
Last updated
All Time
Detection languages
1,883
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,845
2,668
2,390
1,718
312
Platforms
4,408
153
89
34
21
Products / Services
1,182
1,146
1,042
668
277
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,463
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
Detects events that appear when a user click on a link file with a powershell command in it
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local
Detects various execution patterns of the CrackMapExec pentesting framework
Detects inline execution of PowerShell code from a file
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
This query was originally published in the threat analytics report, Confluence and WebLogic abuse.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader
Detects suspicious ways to run Invoke-Execution using IEX alias
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects suspicious command lines used in Covenant luanchers
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Detects suspicious powershell command line parameters used in Empire
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.
The "--headless" flag hides the windows from the user upon execution.
Page 189 of 213