Benjamin Zulliger
@benschaTrusted contributorCompletionist
27 followers229 downloads1,629 copies143 likes20,855 views
55 detections
Filters
Last updated
All Time
Detection languages
55
Categories
19
10
9
8
8
Platforms
29
15
6
4
4
Products / Services
24
8
8
5
4
MITRE Techniques
24
20
19
18
16
CVEs
1
This rule detects emails containing URLs that match domains identified as phishing domains by cert.pl. It joins email URL information with a regularly updated list of known malicious domains from cert.pl and then correlates these with email events to identify potential phishing attempts.
This query is designed to detect a series of anomalous user behaviors that, when combined, may indicate a compromised account. It flags activity that is uncharacteristic for a specific user, such as performing an unusual action, using an unfamiliar application, connecting from an unexpected ISP or country, or logging in from a new device for the first time. The final filter | where InvestigationPriority > 5 focuses the results on high-priority alerts, which are more likely to be legitimate threats. This approach uses behavioral analytics to identify deviations from a user's normal baseline, making it effective for detecting both insider threats and external attacks that have breached credentials.
This KQL query analyzes driver load events on Windows endpoints to detect malicious activity. It specifically looks for drivers (.sys files) being loaded from non-standard, user-writable directories.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
The query checks for DriverLoad events and filters for files ending with .sys. It then narrows the results to drivers loaded from suspicious folders like \Users\, \AppData\, and \Temp\. The query uses a comprehensive exclusion list to filter out known legitimate drivers from these locations, such as those related to Windows Defender, specific gaming anti-cheat software, or hardware utilities like CPU-Z, which often operate from temporary directories. The final output is a list of suspicious driver load events that may indicate a malicious driver being executed on the system.
This KQL query is designed to detect a key technique used in the Valley RAT campaign, as detailed in the HexaStrike blog post. The rule focuses on a classic "Bring Your Own Vulnerable Driver" (BYOVD) attack method where an attacker installs a malicious driver or executable as a new service to achieve persistence and high-level privileges.
Detection Logic
The query analyzes DeviceRegistryEvents to identify suspicious changes to Windows services:
Service Path Manipulation: It specifically looks for modifications to the ImagePath registry value. This value tells Windows which file to execute when a service starts.
Suspicious Locations: The core of the detection is a filter for services whose ImagePath points to an unusual location, such as a temporary (%TEMP%) or program data directory (C:\ProgramData). Legitimate system drivers are almost always loaded from the C:\Windows\System32\drivers folder.
Exclusions: To reduce false positives, the rule excludes known legitimate processes, like those related to Microsoft Defender, that might write to these directories.
By identifying services that are configured to load files from untypical paths, this detection rule effectively uncovers a common tactic used by attackers to bypass security controls and establish a foothold on a system.
Detection Logic
The query analyzes DeviceRegistryEvents to identify suspicious changes to Windows services:
Service Path Manipulation: It specifically looks for modifications to the ImagePath registry value. This value tells Windows which file to execute when a service starts.
Suspicious Locations: The core of the detection is a filter for services whose ImagePath points to an unusual location, such as a temporary (%TEMP%) or program data directory (C:\ProgramData). Legitimate system drivers are almost always loaded from the C:\Windows\System32\drivers folder.
Exclusions: To reduce false positives, the rule excludes known legitimate processes, like those related to Microsoft Defender, that might write to these directories.
By identifying services that are configured to load files from untypical paths, this detection rule effectively uncovers a common tactic used by attackers to bypass security controls and establish a foothold on a system.
This KQL query is designed to enrich "Malicious URL Click" alerts by correlating them with user sign-in activity. It finds the affected accounts and then checks if they had a successful login from a new IP address around the time of the alert. The final output flags high-risk events where a user's URL click activity is immediately followed or preceded by a login from an IP they've never used before. This helps prioritize investigation into potentially compromised accounts.
Page 6 of 6