Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
This query was originally published in the threat analytics report, WDigest credential harvesting.
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
The following query returns any attempts to turn WDigest credential caching on through the registry.
References:
https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
SAM Dump to AppData
Sigma
Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references
Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
Detects service installation in suspicious folder appdata
Detects RemCom service installation and execution events
Detects rare service installs that only appear a few times per time frame and could reveal password dumpers, backdoor installs or other types of malicious services
This query looks for signs of impacket dcomexec module.
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
Author: Jouni Mikkola
More info: https://threathunt.blog/impacket-part-2/
'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'
Detects a service installation that uses a suspicious double ampersand used in the image path value
Detects service creation persistence used by the Goofy Guineapig backdoor
This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET
This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky
Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report
Detects the creation of new services potentially related to COLDSTEEL RAT
Detects application popup reporting a failure of the Sysmon service
Page 47 of 61