Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.
Detects when a file with a suspicious extension is created in the startup folder
'This query identifies when a process execution command-line indicates that a registry value is written to allow for later execution a malicious script
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects registry entries that may indicate that an operator is trying to establish persistence for the Qakbot binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects registry entries that may indicate that an operator is trying to establish persistence for the Qakbot binary.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
This rule detects attempts to hijack legitimate RDP sessions to establish persistence on the RDP source machine. Specifically, it looks for file creation events where the 'mstsc.exe' process (Microsoft Remote Desktop Connection client) is involved in writing a file to a user's 'Startup' folder. This technique can be used by an attacker to place a backdoor or malicious executable that will run automatically when the user logs into the RDP source machine.
Detect modification of the startup key to a path where a payload could be stored to be launched during startup
The following query look for suspicious behaviors observed by the samples analyzed in the report.
Detects modification of autostart extensibility point (ASEP) in registry
Detects modification of autostart extensibility point (ASEP) in registry
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects modification of autostart extensibility point (ASEP) in registry
Detects potential PowerShell commands or code within registry run keys
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
The following analytic detects a suspicious registry modification that enables auto admin logon on a host. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the "AutoAdminLogon" value within the "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" registry path. This activity is significant because it was observed in BlackMatter ransomware attacks to maintain access after a safe mode reboot, facilitating further encryption. If confirmed malicious, this could allow attackers to automatically log in and continue their operations, potentially leading to widespread network encryption and data loss.
The analytic detects the execution of mshta.exe via registry entries to run malicious scripts. It leverages registry activity logs to identify entries containing "mshta," "javascript," "vbscript," or "WScript.Shell." This behavior is significant as it indicates potential fileless malware, such as Kovter, which uses encoded scripts in the registry to persist and execute without files. If confirmed malicious, this activity could allow attackers to maintain persistence, execute arbitrary code, and evade traditional file-based detection methods, posing a significant threat to system integrity and security.
Page 58 of 59