Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
3
3
3
1
1
Contributors
4
2
2
1
1
Categories
3
3
2
2
2
Platforms
9
4
4
1
Products / Services
3
2
2
2
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
3
IDS Protocols
2
1
Detects malicious command-line activity associated with the XHOPELESS v1.0 wiper, specifically targeting firmware/BIOS/UEFI integrity. The detection covers WMI-based corruption of BIOS attributes, abuse of OEM-specific BIOS management namespaces, execution of legitimate firmware update tools with suspicious flags, modification of registry keys intended to disable firmware updates, and interaction with specific UEFI NVRAM GUIDs.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
Generic rule content from file: TOKYOCORE Wiper Clearing UEFI Secure Boot Keys via PowerShell
Detects attempts to modify Cisco ROMMON firmware for deep persistence
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
Detect a system being shutdown or put into different boot mode
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
Establishes a baseline SystemGuardSecurityLevel and show the devices that are below that baseline.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
See https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-insights-from-system-attestation-and-advanced-hunting-can/ba-p/969252 for full details on this query.
And Device Boot Attestation Info and feel free to ping @DepletionMode or @flyingbluemonki on twitter.
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
