Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
10
3
2
1
Contributors
4
3
3
2
2
Categories
4
4
3
3
3
Platforms
13
2
1
1
1
Products / Services
8
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects the physical connection of unauthorized IP-KVM devices (e.g., PiKVM) to corporate endpoints, which could be used for remote control via HDMI capture and USB HID emulation. This detection monitors Plug and Play (PnP) events for specific device descriptors and hardware identifiers commonly associated with remote access hardware.
This rule monitors for the connection of specific KVM-over-IP hardware devices (e.g., PiKVM, Guermok) which can be used by an adversary to gain remote access to a system's physical keyboard, video, and mouse interface, effectively bypassing software-based security controls.
This rule monitors for the connection of specific KVM-over-IP hardware devices (e.g., PiKVM, Guermok) which can be used by an adversary to gain remote access to a system's physical keyboard, video, and mouse interface, effectively bypassing software-based security controls.
This rule monitors for the connection of specific KVM-over-IP hardware devices (e.g., PiKVM, Guermok) which can be used by an adversary to gain remote access to a system's physical keyboard, video, and mouse interface, effectively bypassing software-based security controls.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
This rule detects network connections to known command and control (C2) infrastructure associated with OMG Cable or Hak5 devices. It specifically looks for HTTP requests where the host header matches 'c2.hak5.org' or 'wifi-pineapple.com'. This indicates potential malicious activity where an attacker might be using these devices for command and control.
This rule detects potential callback activity from a remote hardware implant. It specifically looks for HTTP requests where the URI contains common callback patterns like '/callback', '/checkin', '/ping', or '/heartbeat', and the User-Agent header indicates a scripting tool such as 'python', 'curl', or 'wget'. The rule also specifies that the HTTP body size should be between 1 and 199 bytes, and it uses a threshold to trigger an alert if 10 such events occur within 60 seconds from the same source.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
KQL Query
KQL Query from file: MDE: Detecting Quick Assist Usage
KQL Query from file: RMM Hunting with Sentinel TI
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
The following query looks for a function call to a method named DetectSandboxie. This method is used in RevengeRAT and AsyncRAT instances involved in a campaign targeting the aviation industry, first observed in 2021. It has also been associated in the past other malware, such as WannaCry and QuasarRAT. Individual PowerShell functions can be detected in the same way in some instances, though care should be taken to ensure that the command name is unique -- otherwise, this query may return many false positives.
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for network connections using any protocols associated with recent RevengeRAT, AsyncRAT, and other malware campaigns targeting the aviation industry.
This activity is often followed by connections to copy-and-paste sites such as pastebin.com, stikked.ch, academia.edu, and archive.org. Many of these connections will occur on non-standard ports.
The following query looks for network connections using any protocols associated with recent RevengeRAT, AsyncRAT, and other malware campaigns targeting the aviation industry.
This activity is often followed by connections to copy-and-paste sites such as pastebin.com, stikked.ch, academia.edu, and archive.org. Many of these connections will occur on non-standard ports.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.