Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
IDS Protocols
4
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
In April of 2020, security researchers observed multiple ransomware campaigns using the same set of techniques.
The following query detects suspicious use of Alternate Data Streams (ADS), which may indicate an attempt to mask malicious activity. These campaigns have been known to deploy ransomware in-memory and exploit ADS.
The See also section below lists more queries related to techniques shared by these campaigns.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://docs.microsoft.com/sysinternals/downloads/streams
Detects the execution of "attrib" with the "+s" flag to mark files as system files
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs
Detects usage of attrib.exe to hide files from users.
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
This technique is abused by several malware families to hide their files from normal users.
This technique is abused by several malware families to hide their files from normal users.
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files
Detects usage of attrib.exe to hide files from users.
Detects the modification of the registry to allow a driver or service to persist in Safe Mode.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
This technique is abused by several malware families to hide their files from normal users.
This technique is abused by several malware families to hide their files from normal users.
Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging
Detects the execution of "attrib" with the "+s" flag to mark files as system files
'Identifies malware that has been hidden in the recycle bin.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
This analytic detects modifications to the Windows registry that disable the display of hidden files. It specifically monitors changes to registry paths associated with hidden file settings. This activity is significant because malware often uses hidden files to evade detection. If confirmed malicious, this behavior could allow an attacker to conceal malicious files on the system, making it harder for security tools and analysts to identify and remove the threat.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values to disable the showing of hidden files and system files. This technique is often abused by malware to hide its files from users.
Detects file write events from or to a fake Recycle.Bin folder, which is often used by malware as a staging directory. Adversaries may create folders with names similar to legitimate system directories (e.g., "RECYCLERS.BIN" instead of "RECYCLER.BIN") to hide their malicious files and evade detection.
Page 5 of 6