Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
6
4
2
1
1
Contributors
3
3
3
3
1
Categories
5
3
3
3
3
Platforms
13
1
1
1
Products / Services
5
4
4
3
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
1
IDS Protocols
1
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
Detects delivery of malicious Outlook form scripts for persistence
Detects delivery of malicious Outlook form scripts for persistence
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
KQL Query
KQL Query from file: Detect & mitigate potential Specula Exploitation
KQL Query
Detects the creation of a new Outlook form which can contain malicious code
The analytic detects the creation or modification of registry keys associated with new Outlook form installations, potentially indicating exploitation of CVE-2024-21378. It leverages data from the Endpoint.Registry datamodel, focusing on registry paths involving InProcServer32 keys linked to Outlook forms. This activity is significant as it may signify an attempt to achieve authenticated remote code execution via malicious form objects. If confirmed malicious, this could allow an attacker to create arbitrary files and registry keys, leading to remote code execution and potential full system compromise.
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects changes to registry values related to Outlook security settings, which could indicate an attempt to modify Outlook's behavior for persistence or other malicious purposes. This rule specifically looks for modifications within the 'SOFTWARE\Microsoft\Office\<version>\Outlook\Security\' registry path.
Detects the creation of a new Outlook form which can contain malicious code