Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
936 detections
Filters
Last updated
All Time
Detection languages
474
185
75
50
39
Contributors
235
180
110
57
47
Categories
423
381
351
168
127
Platforms
581
297
49
29
22
Products / Services
219
160
135
103
88
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
936
CVEs
26
25
25
17
16
IDS Classtypes
7
5
4
4
4
IDS Protocols
12
10
4
Detects the load of known vulnerable drivers via their names only.
Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level
The query for malicious file creations via TOCTOU Vulnerability in Leading Endpoint Detection and Response (EDR) and Antivirus (AV) Solutions.
- Microsoft Defender (CVE-2022-37971)
- Defender for Endpoint (CVE-2022-37971)
- SentinelOne EDR
- TrendMicro Apex One (CVE-2022-45797)
- Avast Antivirus (CVE-2022-4173)
- AVG Antivirus (CVE-2022-4173)
- Microsoft Defender (CVE-2022-37971)
- Defender for Endpoint (CVE-2022-37971)
- SentinelOne EDR
- TrendMicro Apex One (CVE-2022-45797)
- Avast Antivirus (CVE-2022-4173)
- AVG Antivirus (CVE-2022-4173)
'Extracts MDATP Alert for a web shell being placed on the server and then enriches this event with information from W3CIISLog to idnetigy the Attacker that placed the shell'
Detects suspicious print spool service (spoolsv.exe) child processes.
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM
This analytic identifies drivers being loaded across the fleet by leveraging a PowerShell script to capture driver data. It helps monitor for unauthorized or malicious drivers that could compromise system integrity, execute arbitrary code, escalate privileges, or maintain persistence within the environment.
Search for the files that are using a compromised certificate associated with the Nobelium campaign.
You can remove the comments to:
1. get the list of devices where there is at least one file signed with the certificate
2. get the list of files signed with the certificate
3. get the list of files signed with the certificate group by Devices
You can remove the comments to:
1. get the list of devices where there is at least one file signed with the certificate
2. get the list of files signed with the certificate
3. get the list of files signed with the certificate group by Devices
This query detects attempts to add attacker devices as allowed IDs for active sync using the Set-CASMailbox command.
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.
Detects loading of known malicious drivers via the file name of the drivers.
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378
Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.
Search for the files that are using a compromised certificate associated with the Lapsus$ group.
You can remove the comments to:
1. get the list of devices where there is at least one file signed with the certificate
2. get the list of files signed with the certificate
3. get the list of files signed with the certificate group by Devices
You can remove the comments to:
1. get the list of devices where there is at least one file signed with the certificate
2. get the list of files signed with the certificate
3. get the list of files signed with the certificate group by Devices
Sticky Keys
KQL
A technique used in numerous ransomware attacks is a Sticky Keys hijack for privilege escalation/persistence. Surface realted alerts with this query.
Looks for users who had a risky sign in (based on Entra ID Identity Protection risk score) and then performed and ElevateAccess action. ElevateAccess operations can be used by Global Admins to obtain permissions over Azure resources.
This query was originally published in the threat analytics report, Msiexec abuse.
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
c2-bluekeep
KQL
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
Page 40 of 45