Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Snip3 is a family of related remote access trojans. Although the malware in this family contain numerous small variations, they all exhibit similar behaviors and techniques.
The following query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware. This technique has been used in recent cases to exfiltrate data, including credentials.
The query may return additional malware or campaigns not necessarily associated with Snip3. However, Microsoft recommends triaging all non-benign results as potential malware.
The following query looks for potentially hollowed processes that may be used to facilitate command-and-control or exfiltration by Snip3 malware. This technique has been used in recent cases to exfiltrate data, including credentials.
The query may return additional malware or campaigns not necessarily associated with Snip3. However, Microsoft recommends triaging all non-benign results as potential malware.
These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs.
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.
This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files created in the Startup folder.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
'This query identifies when a new trust monitor event is detected.'
'This query uses Sysmon Image Load (Event ID 7) and Process Create (Event ID 1) data to look for COM Event System being used to load a newly seen DLL.'
'This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days.'
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
Find distinct evasion and execution activities.
Associated with the Robbinhood ransomware campaign.
Associated with the Robbinhood ransomware campaign.
apt sofacy
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Device Logons from Unknown IP Addresses.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
This query looks for events that are near in time to a detected event.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
This query is using the locations where malicious DLL images are often loaded from by regsvr32.dll and rundll32.exe.
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
The query checks process command lines arguments and parent/child combinations to find machines where there have been.
Attempts to exploit a DHCP remote code command injection CVE-2018-1111.
DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
CVE: CVE-2018-1111.
Read more here:.
Https://access.redhat.com/security/cve/cve-2018-1111.
Https://www.cvedetails.com/cve/CVE-2018-1111.
Tags: #exploit #CVE-2018-1111 #DynoRoot.
Attempts to exploit a DHCP remote code command injection CVE-2018-1111.
DynoRoot is a remote command injection present in a script included by the DHCP client in Red Hat Enterprise Linux 6 and 7.
Using it, a malicious attacker could use this flaw to execute arbitrary commands with root privileges.
CVE: CVE-2018-1111.
Read more here:.
Https://access.redhat.com/security/cve/cve-2018-1111.
Https://www.cvedetails.com/cve/CVE-2018-1111.
Tags: #exploit #CVE-2018-1111 #DynoRoot.
'This alerts when the account setting is changed to allow either external domain access or anonymous access to meetings.'
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
Page 354 of 401