Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
8
Contributors
4
3
1
Categories
6
5
2
2
2
Platforms
8
Products / Services
7
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
KQL Query from file: FileFix Detection
KQL Query
KQL Query from file: Suspicious MSHTA Usage
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
Use this query to locate persistence in Startup with HTA files.
This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.