Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,
and GPU driver products/versions.
including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS,
and GPU driver products/versions.
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the `wmic` command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
free space, and other disk information. This can be done using the `wmic` command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the `wmic` command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
free space, and other disk information. This can be done using the `wmic` command-line utility and has been
observed being used by threat actors such as Volt Typhoon.
Detects usage of the "systeminfo" command to retrieve information
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
This query finds anomalous models discovered
'This query will identify the Microsoft Defender Antivirus Security Intelligence version, Security Intelligence up to date value, Engine version, Engine up to date value, Product version (aka Platform version),Product (aka Platform) up to date value, Security Intelligence publish/build timestamp, Security intel refresh timestamp and provide a list of devices with these details.'
This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
Detects attempts to query system information directly from the Windows Registry.
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Detects usage of the "systeminfo" command to retrieve information
Attackers can use Adfind which is administrative tool to gather information about domain controllers or ADFS servers. They may also rename executables with other benign tools on the system.
The below query will look for Adfind usage in command line arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
1. AdFind Recon
2. Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents
3. Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers
This query is inspired by a Azure Sentinel detection.
The below query will look for Adfind usage in command line arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
1. AdFind Recon
2. Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents
3. Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers
This query is inspired by a Azure Sentinel detection.
Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities
This LDAP query cover MetaSploit - enum_ad_computers tool
This LDAP query cover MetaSploit - enum_ad_computers tool
This query looks for common webserver process names and identifies any processes launched using a scripting language (cmd, powershell, wscript, cscript), common initial profiling commands (net \ net1 \ whoami \ ping \ ipconfig),or admin commands (sc). Note that seeing thisactivity doesn't immediately mean you have a breach, though you might consider reviewing and honing the where clause to fit your specific web applications.
Those who don't mind false positives should consider also adding database process names to this list as well (i.e. sqlservr.exe) to identify potential abuse of xp_cmdshell.
Those who don't mind false positives should consider also adding database process names to this list as well (i.e. sqlservr.exe) to identify potential abuse of xp_cmdshell.
EmojiHunt
KQL
Did you know you can use Emojis in Windows?.
Read more here: https://davidzych.com/abusing-emoji-in-windows.
Check-out who in your organization has renamed his or her computer to a Pizza or to a smiling poop.
You might be amused by the results, or perhaps angry if one of your systems or scripts was broken by this...
Note: this query will also return some machines with non-English charcters that are not Emojis.
Credit for this query goes to miflower - thanks for bringing joy to our lives! :).
Read more here: https://davidzych.com/abusing-emoji-in-windows.
Check-out who in your organization has renamed his or her computer to a Pizza or to a smiling poop.
You might be amused by the results, or perhaps angry if one of your systems or scripts was broken by this...
Note: this query will also return some machines with non-English charcters that are not Emojis.
Credit for this query goes to miflower - thanks for bringing joy to our lives! :).
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Page 34 of 39