Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
16
3
3
3
2
Contributors
10
6
4
3
2
Categories
15
12
3
2
2
Platforms
20
5
2
1
Products / Services
6
4
4
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
1
IDS Protocols
1
1
1
The following analytic identifies the use of the w32tm.exe utility with the /stripchart function, which is indicative of DCRat malware delaying its payload execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line arguments used by w32tm.exe. This activity is significant as it may indicate an attempt to evade detection by delaying malicious actions such as C2 communication and beaconing. If confirmed malicious, this behavior could allow an attacker to maintain persistence and execute further malicious activities undetected.
Detects execution patterns associated with the DragonReturn loader, which implements a timing delay loop using GetTickCount64 before executing secondary actions, such as deploying a Windows service via sc.exe.
Detects the execution of the Linux uptime utility, either as a standalone process or via common web server parent processes (nginx, httpd, apache), particularly when associated with suspicious command-line arguments or network activity. This behavior is often associated with reconnaissance or post-exploitation activities.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
Detects use of net time command for system time discovery
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command line containing 'time /domain' within 10 minutes after 'quickassist.exe' has been executed. This behavior can indicate an adversary performing system time discovery or domain reconnaissance after gaining initial access or establishing remote access via Quick Assist.
Detects attempts to query system information directly from the Windows Registry.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
Detects attempts to query system information directly from the Windows Registry.
When configured with suitable command line arguments, w32tm can act as a delay mechanism
When configured with suitable command line arguments, w32tm can act as a delay mechanism
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.
Detects attempts to query system information directly from the Windows Registry.
Description:.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
'The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in.
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
The analytic identifies the use of the w32tm.exe utility with specific command-line arguments (/stripchart, /computer:localhost, /period:, /dataonly, /samples:). This combination of arguments is indicative of DCRat malware delaying its payload execution to evade detection. The detection leverages Endpoint Detection and Response (EDR) data to monitor process creation events and their associated command-line arguments. This activity is significant as it may indicate an attempt to evade detection by delaying malicious actions such as C2 communication and beaconing, potentially allowing an attacker to maintain persistence and execute further malicious activities undetected.
Detects scenarios where a potentially unauthorized application or user modifies the system time. This can be an indicator of defense evasion or an attempt to disrupt system operations or forensic analysis.
Page 1 of 2