Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
38
35
14
13
7
Contributors
18
14
13
13
12
Categories
50
41
25
20
17
Platforms
112
8
4
2
1
Products / Services
27
24
17
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
4
1
IDS Protocols
5
Detects potential Dridex acitvity via specific process patterns
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects the use of Advanced Port Scanner.
This query uncovers seen IPAddressV4 network subnets
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
Description:.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
The query looks for several different MITRE techniques, grouped by risk level.
A weighting is applied to each risk level and a total score calculated per machine.
Techniques can be added/removed as required.
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
This query uncovers seen IPAddressV6 network subnets
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
This analytic detects a single source computer accessing Windows administrative shares (C$, Admin$, IPC$) on 30 or more remote endpoints within a 5-minute window. It leverages Windows Event IDs 5140 and 5145, which are generated for file share events. This behavior is significant as it may indicate an adversary enumerating network shares to locate sensitive files, a common tactic used by threat actors for reconnaissance and lateral movement. If confirmed malicious, this activity could lead to unauthorized access to critical data, lateral movement, and potential compromise of multiple systems within the network.
This analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
This analytic detects a single source computer authenticating to 30 or more remote endpoints within a 5-minute timespan using Windows Event ID 4624 (successful logon). This behavior is identified by analyzing Windows Event Logs for LogonType 3 (network logon) events and counting unique target computers. Such activity is significant as it may indicate lateral movement or network share enumeration by an adversary. If confirmed malicious, this could lead to unauthorized access to multiple systems, potentially compromising sensitive data and escalating privileges within the network.
The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities.
The analytic detects a high volume of Kerberos service ticket requests (more than 30) from a single source within a 5-minute window, specifically focusing on requests with computer names as the Service Name (Event ID 4769). This behavior may indicate malicious activities such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access and network compromise.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects the execution of Advanced IP Scanner, a tool often used by ransomware groups for network discovery. The rule identifies the tool by its image name, original file name, description, or specific command-line arguments indicating portable execution.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
This rule detects the use of the PowerShell cmdlet 'Get-SmbShare', which adversaries may use to discover shared folders and drives on remote systems. This information can be leveraged for data collection or lateral movement within a network.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
Page 5 of 6