Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
167 detections
Filters
Last updated
All Time
Detection languages
58
48
39
10
5
Contributors
38
32
20
19
15
Categories
84
63
56
20
15
Platforms
152
13
6
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
87
63
34
28
26
CVEs
3
3
1
1
1
IDS Classtypes
2
1
IDS Protocols
3
This analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
The following analytic detects modifications in the Windows registry to disable Windows Error Reporting (WER) settings. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to registry paths related to WER with a value set to "0x00000001". This activity is significant as adversaries may disable WER to suppress error notifications, hiding the presence of malicious activities. If confirmed malicious, this could allow attackers to operate undetected, potentially leading to prolonged persistence and further exploitation within the environment.
The following analytic detects a modification to the Windows registry setting "LongPathsEnabled," which allows file paths longer than 260 characters. This detection leverages data from the Endpoint.Registry datamodel, focusing on changes to the specific registry path and value. This activity is significant because adversaries, including malware like BlackByte, exploit this setting to bypass file path limitations, potentially aiding in evasion techniques. If confirmed malicious, this modification could facilitate the execution of long-path payloads, aiding in persistence and further system compromise.
The following analytic detects suspicious modifications to the Windows registry keys related to file compression color and information tips. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the "ShowCompColor" and "ShowInfoTip" values under the "Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced" path. This activity is significant as it was observed in the Hermetic Wiper malware, indicating potential malicious intent to alter file attributes and user interface elements. If confirmed malicious, this could signify an attempt to manipulate file visibility and deceive users, potentially aiding in further malicious activities.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". This activity is often associated with defense evasion tactics to allow adversary communications or lateral movement.
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. Adversaries may modify system firewalls to bypass controls limiting network usage, enabling C2 communications, lateral movement, and/or data exfiltration.
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.
Detects when all rules have been deleted from the Windows Defender Firewall configuration. This action can be performed by an attacker to bypass network controls and facilitate command and control, lateral movement, or data exfiltration.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
Detects the use of 'netsh.exe' commands to disable the Windows firewall. This includes commands targeting both the legacy 'firewall' context and the 'advfirewall' (Windows Defender Firewall with Advanced Security) context, specifically looking for parameters that set the firewall state to disabled or off.
This rule detects the execution of the 'netsh.exe' utility specifically when it is used to modify existing Windows Advanced Firewall rules. The detection logic looks for 'netsh.exe' being executed with the 'advfirewall' and 'set' options in the command line, indicating an attempt to change properties of an already defined firewall rule. This activity could be indicative of an adversary attempting to bypass network controls to facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of `netsh.exe` commands that modify the Windows Firewall to whitelist a program. Specifically, it looks for `netsh.exe` being executed with arguments to 'add allowedprogram' or 'add rule' with 'action=allow' and 'program=' where the program path is located in suspicious directories such as Recycle Bin, System Volume Information, Temp folders, or various Windows system subdirectories that are not typical locations for legitimate applications requiring firewall exceptions.
This rule detects when the Windows Defender Firewall service fails to load Group Policy. This event can indicate an issue with the firewall configuration being applied, potentially leading to a weakened security posture or unexpected network behavior. Adversaries might attempt to interfere with firewall policy loading to bypass defenses.
This rule detects when the Windows Defender Firewall configuration has been reset to its default settings. This action can indicate an attempt by an adversary to disable or modify firewall rules to bypass network controls, facilitate C2 communications, or enable lateral movement. It specifically looks for Event IDs 2032 (for most Windows versions) and 2060 (for Windows 11) from the firewall-as log source.
Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.
Detects the usage of the `netsh.exe` command-line utility to modify system firewall rules, specifically to open port 3389 for RDP connections. This activity has been observed in campaigns involving the Sarwent malware, where adversaries manipulate firewall settings to enable remote access.
Detects the addition of a new rule to the Windows firewall using the 'netsh.exe' command-line utility. This activity can indicate an adversary attempting to bypass network controls for C2 communications, lateral movement, or data exfiltration.
This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.
This rule detects attempts to disable the Windows Firewall using PowerShell. It specifically looks for PowerShell process creations that include commands to set the NetFirewallProfile to 'False' for any profile ('All', 'Public', 'Domain', or 'Private'). This activity is often performed by adversaries to bypass host-based firewalls and facilitate further malicious activity.
Page 8 of 8