Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
58
33
7
2
2
Contributors
22
14
11
8
8
Categories
48
21
15
12
11
Platforms
84
8
4
3
3
Products / Services
21
19
15
6
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
'This query detects authentication attempt from a fake computer account(username ends with $).
Computer accounts are normally not authenticating via interactive logon or remote desktop neither they are unlocking the systems.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
Computer accounts are normally not authenticating via interactive logon or remote desktop neither they are unlocking the systems.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
'Identifies malware that has been hidden in the recycle bin.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
Detects the execution of the 'mount' command with the 'hidepid=2' option. This parameter is used to hide processes from other users on the system, which can be leveraged by adversaries for defense evasion by making their malicious processes less visible.
The analytic detects the creation of Kubernetes pods in the default, kube-system, or kube-public namespaces. It leverages Kubernetes audit logs to identify pod creation events within these specific namespaces. This activity is significant for a SOC as it may indicate an attacker attempting to hide their presence or evade defenses. Unauthorized pod creation in these namespaces can suggest a successful cluster breach, potentially leading to privilege escalation, persistent access, or further malicious activities within the cluster.
The analytic detects the modification of the Windows registry to disable the Folder Options feature, which prevents users from showing hidden files and file extensions. This activity is commonly used by malware to conceal malicious files and deceive users with fake file extensions. If confirmed malicious, this could allow an attacker to hide their presence and malicious files, making detection and remediation more difficult.
The analytic detects changes in a Windows service's security descriptor where a new deny access control entry (ACE) has been added. It specifically looks for executions of 'sc.exe' with the 'sdset' flag, targeting any service, and including a deny ACE. Such modifications can be used by attackers to escalate privileges, disable security services, or blind defenses by preventing legitimate users or services from interacting with the modified service.
The following analytic detects changes in a service security descriptor where a new deny ace has been added. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for any process execution involving the "sc.exe" binary with the "sdset" flag targeting any service and adding a dedicated deny ace. If confirmed malicious, this could allow an attacker to escalate their privileges, blind defenses and more.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Detects a potentially suspicious execution where a parent process located in the "\Users\Public" folder executes a child process that is a common shell or scripting binary, indicated by its image name or command line arguments. This behavior is often associated with malware attempting to hide in a publicly accessible directory and then execute further malicious commands.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
This rule detects error messages generated by Sysmon when it fails to open its service configuration or connect to its driver to update the configuration. These errors can indicate an adversary's attempt to tamper with or disable Sysmon logging to evade detection. The rule specifically filters out known false positives related to write-protected media or specific error codes (19, 93) to reduce noise.
Page 5 of 6