Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
2
Contributors
5
2
Categories
4
3
2
2
1
Platforms
7
Products / Services
3
3
2
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.
Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
'This query uses Sysmon Image Load (Event ID 7) and Process Create (Event ID 1) data to look for COM Event System being used to load a newly seen DLL.'
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
'This query looks for changes to COM registry keys to point to files in C:\Windows\System32\spool\drivers\color\.
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This can be used to enable COM hijacking for persistence.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'