Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
545 detections
Filters
Last updated
All Time
Detection languages
272
102
85
38
17
Contributors
152
88
64
55
44
Categories
97
86
85
85
82
Platforms
299
182
64
41
35
Products / Services
10,665
9,773
6,705
4,421
3,749
545
MITRE Techniques
191
175
144
100
91
CVEs
19
18
12
6
6
IDS Classtypes
21
14
1
1
1
IDS Protocols
37
1
The following analytic detects modifications to the Windows registry that disable security settings for Terminal Services. It leverages the Endpoint data model, specifically monitoring changes to the registry path associated with Terminal Services security settings. This activity is significant because altering these settings can weaken the security posture of Remote Desktop Services, potentially allowing unauthorized remote access. If confirmed malicious, such modifications could enable attackers to gain persistent remote access to the system, facilitating further exploitation and data exfiltration.
The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. It detects this activity by monitoring the MSExchangeMailboxReplication.exe process, which typically does not write .aspx files. This behavior is significant as it may indicate an active exploitation attempt on Exchange servers. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, or maintain persistence within the environment. Immediate investigation and remediation are crucial to prevent further compromise.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This variant uses the OWA endpoint to access the PowerShell backend endpoint, indicated by specific URI patterns and HTTP methods. The rule filters out common legitimate user agents to reduce false positives.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This exploit leverages the Outlook Web Access (OWA) endpoint to gain access to the PowerShell backend endpoint, indicated by specific URI patterns, HTTP method, user-agent, and a successful HTTP status code.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
This rule detects specific patterns indicative of successful ProxyLogon exploitation targeting Microsoft Exchange's OabVirtualDirectory. It looks for the invocation of the 'Set-OabVirtualDirectory' cmdlet in conjunction with suspicious parameters often used in post-exploitation activities, such as injecting web shell code ('eval(request'), or manipulating the ExternalUrl with malicious scripts ('http://f/<script', '"unsafe"};', 'function Page_Load()'). This combination suggests an attacker has successfully leveraged the ProxyLogon vulnerabilities to execute arbitrary commands and modify Exchange configurations for persistence or further access.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This rule specifically looks for requests to the OWA endpoint attempting to access the PowerShell backend endpoint, characterized by a specific user agent, POST method, successful status code (200), and URI query containing both '/owa/mastermailbox' and '/powershell'. This indicates an attempt to leverage the vulnerability for remote code execution.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This exploit leverages the OWA endpoint to access the PowerShell backend endpoint, often associated with CVE-2022-41080 and CVE-2022-41082.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
This rule detects the removal of an exported Exchange mailbox using the 'Remove-MailboxExportRequest' cmdlet with the '-Confirm "False"' parameter. This activity could indicate an adversary attempting to cover their tracks after exfiltrating data, potentially following an exploit like ProxyShell.
This rule detects failed attempts to install an Exchange Transport Agent. It specifically looks for Event ID 6 in the MSExchange Management logs and the string 'Install-TransportAgent' within the event data. This could indicate an adversary attempting to establish persistence on an Exchange server.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
This rule detects potential successful exploitation of CVE-2021-26857, a Microsoft Exchange Server vulnerability. It specifically looks for abnormal child processes spawning from the 'UMWorkerProcess.exe' (Unified Messaging service) on Exchange servers. The rule filters out legitimate Windows Error Reporting processes ('wermgr.exe' and 'WerFault.exe') to reduce false positives, indicating that any other process spawned by 'UMWorkerProcess.exe' is considered suspicious and a potential indicator of compromise.
Detects successful exploitation attempts of the Microsoft Exchange Server vulnerability CVE-2021-28480. This vulnerability allows for remote code execution. The rule specifically looks for POST requests to '/owa/calendar/a' that result in an HTTP 503 status code, indicating a potential successful exploitation or a server error due to the exploit.
Detects exploitation attempts of the Microsoft Exchange vulnerability CVE-2020-0688. This vulnerability allows for remote code execution due to improper validation of cmdlet arguments. The rule specifically looks for GET requests to '/ecp/' or '/owa/' paths containing '__VIEWSTATE=' in the query string, which is indicative of the exploitation attempt.
Detects exploitation attempts targeting Microsoft Exchange servers, specifically those associated with the HAFNIUM group's activity. The rule looks for suspicious POST requests to specific URI paths and user-agent strings that were observed during the HAFNIUM attacks.
Page 25 of 26