Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
'Identifies the host and account that executed AdFind by hash and filename in addition to common and unique flags that are used by many threat actors in discovery.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time).
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
'Provides the Anti virus mode and device count falling under that AV mode.'
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1
Use of reg to get MachineGuid information
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Use of reg to get MachineGuid information
Use of hostname to get information
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This query calculates device uptime based on periodic DeviceInfo which is recorded every 15 minutes regardless of device's network connectivity and uploaded once device gets online. If its interval is over 16 minutes, we can consider device is turned off.Calculated uptime may include up to 30 minutes gap. Devices may be turned on up to 15 minutes earlier than the "timestamp", and may be turned off up to 15 minutes later than the "LastTimestamp". When the single independent DeviceInfo without any sequential DeviceInfo within 16 minutes before or after is recorded, "DurationAtLeast" will be displayed as "00.00:00:00".
This query will count the number of devices in Defender ATP based
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
on their DNS suffix. For a full list of devices with the DNS
suffix, comment out or remove the last line.
This query uses the public MDE GitHub repo as a source to estimate the time that an agent build remains supported
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
based on the time it was uploaded. Please note that the timestamps used in this query are meant to estimate the
support period and will likely not represent the actual expiration of the package which will be based on the build.
If you would like an estimate of support, uncomment the extend statement to get an idea of what is \ is not
supported and an idea of how long support will remain for current agents.
This query currently only supports GA builds, not preview builds.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy_zebrocy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
This query was originally published in the threat analytics report, Operation Soft Cell.
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators sometimes use legitimate web server processes to launch commands, especially for network discovery and user/owner discovery. The following query detects activity of this kind.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Identify dllhost.exe using WMIC to discover additional hosts and associated domain.
This query searches for not onboarded devices with a specific prefix
Page 35 of 39