Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
36
19
7
5
2
Contributors
23
18
4
4
4
Categories
54
37
14
11
6
Platforms
72
3
Products / Services
30
27
16
5
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
IDS Protocols
1
1
Detects MSBuild used with inline task to execute arbitrary code
Detects trusted developer utilities abused as execution proxies for defense evasion
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
This rule detects instances where MSBuild.exe initiates network connections to external IP addresses. MSBuild.exe is a legitimate Microsoft utility, but it can be abused by adversaries to proxy execution of malicious code and establish command and control (C2) communications. The rule filters out connections to internal, loopback, and non-routable IP spaces to focus on potentially malicious external communication attempts.
Detects a possible remote connections to Silenttrinity c2
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.
Detects the execution of the Microsoft Build Engine (msbuild.exe) with a project file (.proj) located in a suspicious, non-standard directory such as C:\ProgramData. This is a known "Living off the Land" technique (T1127.001) used by adversaries, including the PHALT#BLYX campaign, to proxy code execution through a trusted binary and evade defenses.
Detects a suspicious process chain involving wscript.exe spawning powershell.exe, which then spawns MSBuild.exe. This specific chain is characteristic of the SHADOW#REACTOR malware campaign, indicating potential execution of malicious code via trusted utilities.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
This rule detects suspicious execution of MSBuild.exe from non-standard user-writable temporary or roaming directories. Adversaries often abuse MSBuild.exe, a legitimate Microsoft utility, to proxy execution of malicious code, bypassing application control defenses. The rule specifically looks for MSBuild.exe running from common temporary or user-controlled paths like AppData\Local\Temp, AppData\Roaming, C:\Temp, or C:\Users\Public, which is indicative of potential malicious activity such as process injection or execution of infostealers like Lumma Stealer.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Detects a possible remote connections to Silenttrinity c2
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
Detects execution of executables that can be used to bypass Applocker whitelisting
Detects execution of executables that can be used to bypass Applocker whitelisting
Detects a possible remote connections to Silenttrinity c2
Page 3 of 4