Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
250
122
32
26
24
Contributors
140
53
39
37
35
Categories
378
174
161
59
47
Platforms
383
98
29
17
10
Products / Services
142
107
48
40
20
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
3
3
2
2
1
IDS Classtypes
2
1
IDS Protocols
2
A General detection to trigger for the creation or modification of .*\Software\Sysinternals\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.
Detects execution of the builtin "rmdir" command in order to delete directories.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Detects execution of the builtin "del"/"erase" commands in order to delete files.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
A General detection to trigger for the creation or modification of .*\Software\Sysinternals\SDelete registry keys. Indicators of the use of Sysinternals SDelete tool.
Detects execution of the builtin "rmdir" command in order to delete directories.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.
Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.
This query helps reviewing malicious email detections by detection methods
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query looks for user content downloads from dropbox that originate from a link/redirect from a 3rd party site.
File sharing sites such as Dropbox are often used for hosting malware on a reputable site.
Read more about download URL data and about this attack vector in this blog post:.
Https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
Tags: #DownloadUrl, #Referer, #Dropbox.
File sharing sites such as Dropbox are often used for hosting malware on a reputable site.
Read more about download URL data and about this attack vector in this blog post:.
Https://techcommunity.microsoft.com/t5/Threat-Intelligence/Hunting-tip-of-the-month-Browser-downloads/td-p/220454.
Tags: #DownloadUrl, #Referer, #Dropbox.
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects if an instance of Qakbot has attempted to overwrite its original binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
This query shows the source of the AV detections (e.g., the website the file was downloaded from etc.).
Get the list of AV detections.
Get the list of AV detections.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query searches for the HASHs of the FireEye Red Team tools compromised by the Nobelium activity group.
See all-hashes.csv on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv
https://github.com/fireeye
See all-hashes.csv on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/all-hashes.csv
https://github.com/fireeye
Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query returns alerts raised when backup files were deleted.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query returns alerts raised when backup files were deleted.
The See also section below lists more queries related to techniques shared by these campaigns.
Reference - https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
List alerts flagging attempts to delete backup files.
// Look for cipher.exe deleting data from multiple drives.
This is often performed as an anti-forensic measure prior to encryption.
This is often performed as an anti-forensic measure prior to encryption.
Page 22 of 24