Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
63
27
11
4
4
Contributors
17
17
13
12
6
Categories
40
25
25
22
17
Platforms
95
39
22
1
1
Products / Services
21
16
14
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects scenarios where an attacker abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where an attacker calls the stickey key and execute CMD.
This KQL detection is designed for use in Microsoft Defender for Endpoint Advanced Hunting or Microsoft Sentinel, depending on table availability.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
It focuses on identifying two common persistence techniques used by threat actors:
COM hijacking via user-specific registry hives (InprocServer32 and LocalServer32), particularly when leveraged by .NET or PowerShell-based malware; and uncommon registry-based persistence through suspicious keys such as DelegateExecute, TreatAs, and ScriptletURL.
The KQL focusses on user-specific registry hives as they don't require elevated privileges to modify and is why we also ignore "nt authority" activity as this detection is focused on low hanging fruit that would be easily accessible to a threat actor initially for persistence without privilege escalation.
Detects potential abuse of the Windows on-screen keyboard (osk.exe) by replacing it with cmd.exe or spawning unusual processes as SYSTEM. This technique can be used for persistence via accessibility features.
Detects the creation of a macro file for Outlook.
Detects the modification of Outlook security setting to allow unprompted execution of macros.
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Detects the creation of a macro file for Outlook.
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Control Panel Items
Sigma
Detects the malicious use of a control panel item
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Control Panel Items
Sigma
Detects the malicious use of a control panel item
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.
The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Page 5 of 6