Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
63
27
11
4
4
Contributors
17
17
13
12
6
Categories
40
25
25
22
17
Platforms
95
39
22
1
1
Products / Services
21
16
14
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Identifies SolarWinds SUNBURST and SUPERNOVA backdoor file hash IOCs in File Events
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimFileEvent)
References:
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimFileEvent)
References:
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.
This analytic detects suspicious command-lines that modify user profile files to automatically execute scripts or executables upon system reboot. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving profile files like ~/.bashrc and /etc/profile. This activity is significant as it indicates potential persistence mechanisms used by adversaries to maintain access to compromised hosts. If confirmed malicious, this could allow attackers to execute arbitrary code upon reboot, leading to persistent control over the system and potential further exploitation.
The following analytic detects the execution of CompatTelRunner.exe with parameters indicative of a process not part of the normal "Microsoft Compatibility Appraiser" telemetry collection. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line arguments. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
This detection identifies suspicious modifications to the Windows Compatibility Telemetry registry settings, specifically within the "TelemetryController" registry key and "Command" registry value. This activity is significant because CompatTelRunner.exe and the "Microsoft Compatibility Appraiser" task always run as System and can be used to elevate privileges or establish a highly privileged persistence mechanism. If confirmed malicious, this could enable unauthorized code execution, privilege escalation, or persistent access to the compromised system.
This rule detects suspicious behaviors associated with the SOURGUM actor, as tracked by Microsoft. Specifically, it looks for the creation of processes with specific image paths related to 'Physmem.sys' or 'WimBootConfigurations.ini' within IME directories. Additionally, it identifies attempts to modify registry keys associated with Component Object Model (COM) objects, specifically InprocServer32 entries for CLSIDs {7c857801-7381-11cf-884d-00aa004b2e24} and {cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}, using the 'reg add' command.
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence via autorun. The rule specifically looks for modifications to the 'Autorun', 'CleanupString', or 'PreCleanupString' registry values within the 'VolumeCaches' key, combined with specific executable names or common suspicious paths in the 'Details' field.
This rule detects attempts to establish persistence by modifying specific registry keys related to the Windows Event Viewer's redirection functionality. Adversaries can manipulate these keys, specifically 'MicrosoftRedirectionProgram' and 'MicrosoftRedirectionURL', to execute arbitrary programs or open malicious URLs when a user interacts with the Event Viewer. The rule filters out legitimate modifications made by svchost.exe (likely via GPO) for default redirection programs and command-line parameters, as well as the default Microsoft events.asp URL and empty values, to reduce false positives.
Page 6 of 6