Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,640 detections
Filters
Last updated
All Time
Detection languages
1,764
375
349
273
255
Contributors
908
661
593
359
164
Categories
1,498
1,162
780
529
520
Platforms
39,950
7,275
6,526
3,865
3,640
Products / Services
812
512
432
342
298
MITRE Techniques
1,184
574
524
506
443
CVEs
17
16
9
8
8
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
'Any Alerts that fired related to a given File during the range of +6h and -3d'
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate an attempt to run Python in service of malicious activity by a remote operator. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can help locate an attempt to run Python in service of malicious activity by a remote operator. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Backdoor processes associated with OceanLotus Mac Malware Backdoor.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS platforms: Macintosh.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
'Any Alerts that fired on any host with this same process in the range of +-1d'
Backdoor processes associated with OceanLotus Mac malware backdoor dropper.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
Detects the execution of the hdiutil utility in order to mount disk images.
This query was originally published in the threat analytics report, Python abuse on macOS
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect the creation of a ransom note according to the typical methods of EvilQuest operators. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect the creation of a ransom note according to the typical methods of EvilQuest operators. The command the query searches for is associated with, but not definitely indicative of, EvilQuest infections.
Other queries related to EvilQuest ransomware can be found under the See also section below.
This query was originally published in the threat analytics report, OSX/SurfBuyer adware campaign.
It will return results if a shell script has furtively attempted to decode and save a file to a /tmp folder.
If discovered on your system, this kind of activity might be associated with SurfBuyer, which is adware that installs a browser extension to take control of several major web browsers, including Safari, Google Chrome, and Firefox.
It will return results if a shell script has furtively attempted to decode and save a file to a /tmp folder.
If discovered on your system, this kind of activity might be associated with SurfBuyer, which is adware that installs a browser extension to take control of several major web browsers, including Safari, Google Chrome, and Firefox.
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
This rule detects when a file, identified as malicious by Google Safe Browsing, initiates an outbound network connection to an IP address known to be a Tor Exit Node, as identified by Google Cloud Threat Intelligence (GCTI) Feed. This indicates potential command and control (C2) communication or data exfiltration by malware attempting to anonymize its network traffic.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
This rule detects the launch of processes whose associated file hash (SHA256) has a low prevalence across the monitored environment. Specifically, it flags processes where the SHA256 hash has been observed on 1 to 3 distinct endpoints over the past 10 days. This can indicate the execution of rare or newly introduced executables, which could be malicious.
Page 167 of 174