Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
8
4
2
1
Contributors
3
2
2
2
1
Categories
6
5
4
3
2
Platforms
12
2
2
2
1
Products / Services
4
2
2
1
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
2
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
This rule detects HTTP traffic to specific Visual Studio Code (VS Code) remote tunnel domains, specifically 'tunnels.api.visualstudio.com' or 'vscode.dev'. A high frequency of such connections (10 times within 60 seconds from the same source) is flagged as potential command and control (C2) activity, indicating the use of VS Code Remote Tunnels as a C2 channel.
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
Detects the execution of the VSCode CLI (code.exe) with the 'tunnel' argument, particularly when executed from uncommon directories like ProgramData or Users\Public, or when automated via piped input. This technique is actively abused by Kimsuky to establish covert C2 channels that bypass traditional network detections.
Detects the execution of VS Code CLI running in tunnel service mode, indicating potential C&C tunneling. Threat actors increasingly abuse VS Code's native tunneling capabilities to establish covert C&C channels that blend with developer traffic.
Detects VS Code CLI (code.exe) executed with the --without-connection-token parameter, which disables authentication for remote tunnel access.
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks. Specifically, it looks for Velociraptor spawning 'code.exe' with tunneling arguments, 'msiexec' with '/i' and 'http' for remote installation, or PowerShell/pwsh executing web requests or file downloads.
Tracks network events involving connections to specific Visual Studio Tunnel API URLs, which are used for remote development scenarios (like Visual Studio Code's Live Share or remote tunneling features).
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
KQL Query from file: Check for Entra Legacy TLS Login
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for network connections using any protocols associated with recent RevengeRAT, AsyncRAT, and other malware campaigns targeting the aviation industry.
This activity is often followed by connections to copy-and-paste sites such as pastebin.com, stikked.ch, academia.edu, and archive.org. Many of these connections will occur on non-standard ports.
The following query looks for network connections using any protocols associated with recent RevengeRAT, AsyncRAT, and other malware campaigns targeting the aviation industry.
This activity is often followed by connections to copy-and-paste sites such as pastebin.com, stikked.ch, academia.edu, and archive.org. Many of these connections will occur on non-standard ports.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.