Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 19052025
KQL Query
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Detects possible Sysmon filter driver unloaded via fltmc.exe
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Detects potential malicious and unauthorized usage of bcdedit.exe
Detect filter driver unloading activity via fltmc.exe
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Might be used by ransomwares during the attack (seen by NotPetya and others).
Detects potential malicious and unauthorized usage of bcdedit.exe
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Shadow Copies deletion using operating systems utilities
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects attempts to use fsutil.exe to clear system logs and delete forensic artifacts.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
This query was originally published by PWC Security Research Team.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
Detect filter driver unloading activity via fltmc.exe
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Page 8 of 10