Azure Sentinel
@AzureSentinel50 followers944 downloads1,418 copies43 likes37,654 views
1,223 detections
Filters
Last updated
All Time
Detection languages
1,223
Categories
220
218
180
171
135
Platforms
766
284
188
78
29
Products / Services
492
297
159
152
93
MITRE Techniques
530
485
467
348
348
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
List alerts flagging attempts to delete backup files.
Identify prior activity from this campaign using IOCs shared by Microsoft's Threat Intelligence Center, or MSTIC.
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
Read more: https://blogs.microsoft.com/on-the-issues/2020/10/28/cyberattacks-phosphorus-t20-munich-security-conference/
// Look for cipher.exe deleting data from multiple drives.
This is often performed as an anti-forensic measure prior to encryption.
This is often performed as an anti-forensic measure prior to encryption.
Find distinct evasion and execution activities.
Associated with the Robbinhood ransomware campaign.
Associated with the Robbinhood ransomware campaign.
apt sofacy
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This is a query to retrieve last 30 days network connections to known Dofoil NameCoin servers.
The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp.
The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp.
Device Logons from Unknown IP Addresses.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query was originally published in the threat analytics report, Emulation-evading JavaScripts.
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files.
See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files.
See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Page 83 of 123