Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
8
3
1
1
Contributors
4
3
3
1
1
Categories
7
2
2
1
1
Platforms
12
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects scenarios where an attacker attempts to register a SIP or trust provider in order to mislead signature validation checks.
KQL Query
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key.
The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key.
The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
The following analytic detects modifications to the Windows Registry SIP Provider. It leverages Sysmon EventID 7 to monitor registry changes in paths and values related to Cryptography Providers and OID Encoding Types. This activity is significant as it may indicate an attempt to subvert trust controls, a common tactic for bypassing security measures and maintaining persistence. If confirmed malicious, an attacker could manipulate the system's cryptographic functions, potentially leading to unauthorized access, data theft, or other damaging outcomes. Review the modified registry paths and concurrent processes to identify the attack source.
The following analytic detects failed trust validation attempts using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically triggers on EventID 81, which indicates that "The digital signature of the object did not verify." This detection leverages the CAPI2 Operational log to identify instances where digital signatures fail to validate. Monitoring this activity is crucial as it can indicate attempts to execute untrusted or potentially malicious binaries. If confirmed malicious, this activity could allow attackers to bypass security controls and execute unauthorized code, leading to potential system compromise.
This analytic identifies all SIP (Subject Interface Package) providers on a Windows system by capturing DLL paths from relevant events. It is designed to detect potentially malicious SIP providers that could bypass trust controls and allow unauthorized code execution. The rule is intended for hunting and inventory purposes, prompting analysts to review for new and non-standard DLL paths to identify potential threats. If confirmed malicious, such activity could subvert system integrity, leading to unauthorized access or persistent threats.
This rule detects attempts to establish persistence and evade defenses by registering a new Subject Interface Package (SIP) provider. Attackers can modify specific registry keys related to cryptographic providers to redirect signature validation functions to malicious DLLs. This allows them to bypass application control mechanisms by making the system trust unsigned or malicious code as legitimately signed. The rule specifically looks for modifications to registry paths associated with Microsoft Cryptography Providers and OID EncodingType, where the 'Dll' or '$DLL' values are being set, while filtering out known legitimate SIP registrations by the OS or specific software like WINTRUST.DLL and mso.dll. It also filters out specific legitimate activity related to poqexec.exe and PsfSip.dll.