Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
24
16
5
4
1
Contributors
11
9
8
4
4
Categories
14
11
9
8
6
Platforms
40
6
6
1
1
Products / Services
17
9
9
7
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Detects if the eBPF sensor of Defender for Endpoint (Linux) is deactivated to evade detections.
KQL Query
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 05052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 24022025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 19052025
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
This query helps in reviewing top policies for admin overrides (Allow/Block)
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
This detects attempts to manipulate audit policies using auditpol command.
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it.
Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
Refer to our M365 blog for details on use during the Solorigate attack:
https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
The process name in each data source is commented out as an adversary could rename it. It is advisable to keep process name commented but if the results show unrelated false positives, users may want to uncomment it.
Refer to auditpol syntax: https://docs.microsoft.com/windows-server/administration/windows-commands/auditpol
Refer to our M365 blog for details on use during the Solorigate attack:
https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query visualises the amount of emails subject to a user type policy with action of block, summarizing the data daily
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
View Defender for Endpoint telemetry URLs and their connection status, view trendline over 30 days.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Detects changes to the ESXi syslog configuration via the 'esxcli' command-line utility. This activity could indicate an adversary attempting to impair defenses by modifying logging configurations on an ESXi hypervisor.
Page 2 of 3