Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects MSI package installation from suspicious locations
Detects Windows error reporting event where the process that crashed is lsass. This could be the cause of an intentional crash by techniques such as Lsass-Shtinkering to dump credential
During exploitation of this vulnerability, two logs (Provider_Name:Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 (maybe lot of false positives with this event) are created. Moreover, it appears the directory \Users\TEMP is created may be created during the exploitation. Viewed on 2008 Server
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Assuming that you have a machine that is properly BitLocker'ed, then
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
'This query looks for errors that may indicate that an attacker is attempting to exploit a vulnerability in the service.
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/'
The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
This rule detects the successful installation of the Atera Remote Monitoring & Management (RMM) agent by looking for specific Event ID 1033 from the MsiInstaller provider, where the message content includes 'AteraAgent'. This activity has been associated with threat actors, specifically Conti operators, using the Atera agent for command and control.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
The analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE", "DROP DATABASE", or "TRUNCATE TABLE". These operations can lead to data loss and impact system availability.
Detects attempts to clear Windows Event Logs using 'wevtutil' command-line utility or PowerShell cmdlets like 'Remove-EventLog' and 'Clear-EventLog'. This activity is often performed by adversaries to remove forensic evidence of their actions on a compromised system.
Detects corrupted packets sent to the MSMQ service, which could indicate an attempt to exploit CVE-2023-21554, a critical remote code execution vulnerability in Microsoft Message Queuing (MSMQ). The rule specifically looks for EventID 2027 with a Level of 2 (Error) from the 'MSMQ' provider in the Windows Application event log.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
This rule detects the installation of Microsoft Installer (MSI) packages directly from a web source. It specifically looks for MsiInstaller events (EventID 1040 or 1042) in the Windows Application event log where the installation data contains a web protocol indicator (e.g., '://'). This behavior can be indicative of an attacker using msiexec.exe to download and execute malicious MSI files from a remote server, potentially bypassing traditional security controls.
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Page 13 of 18