Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
21
9
6
2
2
Contributors
12
9
6
3
3
Categories
28
14
12
5
4
Platforms
37
3
1
1
1
Products / Services
14
10
6
4
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
KQL Query from file: Malicious NPM Package post install script
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields
Detects the execution of WMIC with the "format" flag to potentially load XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Detects the execution of WMIC with the "format" flag to potentially load XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.
Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.
The following query looks for keywords observed in emails involved in a Snip3-associated campaign in April and May of 2021. The emails often have an aviation theme, and the campaign primarily targets organizations involved in travel or aviation. Note that keywords may change overtime. These emails were used to send malicious legitimate hosting provider links that redirected to VBS documents hosting loaders. The loaders initiate RevengeRAT or AsyncRAT downloads that eventually establish persistence on targets and exfiltrate data.
The analytic detects the execution of an XSL script using the WMIC process, which is often indicative of malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving WMIC and XSL files. This behavior is significant as it has been associated with the FIN7 group, known for using this technique to execute malicious scripts. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to system compromise and further malicious actions within the environment.
Detects potential SquiblyTwo attack technique where WMIC is used to execute remote XSL files. This rule specifically looks for WMIC execution with command-line arguments indicating a format specifier and an HTTP URL, combined with checks for the original WMIC executable name or known WMIC ImpHashes, even if the binary is renamed.
Detects the execution of the 'msxsl.exe' utility with an 'http' keyword in the command line, indicating a potential attempt to execute XSL files from a remote source. This technique can be used by adversaries to bypass application control and execute malicious scripts.
Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). This rule specifically looks for `wmic.exe` loading scripting libraries like `jscript.dll` or `vbscript.dll`.
Msxsl.EXE Execution
Sigma
Detects the execution of the MSXSL utility (msxsl.exe). This utility can be abused by adversaries to execute Extensible Stylesheet Language (XSL) files, potentially bypassing application whitelisting defenses and executing arbitrary code. The rule specifically looks for the execution of 'msxsl.exe'.
Page 2 of 2