Kenji Choy
@kchoyCompletionist
0 followers124 downloads299 copies8 likes27,553 views
23 detections
Filters
Last updated
All Time
Detection languages
15
8
Categories
4
3
3
3
2
Platforms
11
3
Products / Services
6
3
1
1
1
MITRE Techniques
6
6
4
4
4
This query is designed to detect suspicious network activity that may indicate the presence of malware using Domain Generation Algorithms (DGA). Here's a simple breakdown of what it does:
Purpose: The query identifies computers (clients) that are communicating with domains generated by malware using DGA. These domains often have random-looking names and are used by malware to connect to command and control (C2) servers.
Detection Method:
It analyzes DNS queries to find domains with certain characteristics:
A high percentage of consonants (more than 65%).
The presence of digits within the domain name.
Domain names that are between 10 and 40 characters long.
These characteristics are typical of DGA-generated domains, which are designed to look random.
Data Source: The query uses DNS activity logs from Windows DNS servers.
Frequency: The query runs every hour and looks at DNS queries from the past hour.
Alerting:
If a computer queries more than 25 domains that match the DGA pattern, an alert is generated.
The alert includes details such as the number of suspicious domains queried, sample domain names, and the time range of the activity.
Severity: The alert is classified as high severity because it indicates potential malware activity.
Use Case: This query is useful for detecting malware like Emotet, QakBot, Dridex, TrickBot, and others that use DGA to evade detection.
Output: The alert provides information about the source computer, including its hostname and IP address, and a sample of the suspicious domains queried.
Overall, this query helps security teams identify and respond to potential malware infections by detecting unusual DNS query patterns indicative of DGA activity.
Purpose: The query identifies computers (clients) that are communicating with domains generated by malware using DGA. These domains often have random-looking names and are used by malware to connect to command and control (C2) servers.
Detection Method:
It analyzes DNS queries to find domains with certain characteristics:
A high percentage of consonants (more than 65%).
The presence of digits within the domain name.
Domain names that are between 10 and 40 characters long.
These characteristics are typical of DGA-generated domains, which are designed to look random.
Data Source: The query uses DNS activity logs from Windows DNS servers.
Frequency: The query runs every hour and looks at DNS queries from the past hour.
Alerting:
If a computer queries more than 25 domains that match the DGA pattern, an alert is generated.
The alert includes details such as the number of suspicious domains queried, sample domain names, and the time range of the activity.
Severity: The alert is classified as high severity because it indicates potential malware activity.
Use Case: This query is useful for detecting malware like Emotet, QakBot, Dridex, TrickBot, and others that use DGA to evade detection.
Output: The alert provides information about the source computer, including its hostname and IP address, and a sample of the suspicious domains queried.
Overall, this query helps security teams identify and respond to potential malware infections by detecting unusual DNS query patterns indicative of DGA activity.
This query is designed to detect potential malicious activity involving PowerShell scripts that are executed as a result of a social engineering attack using fake CAPTCHA or bot verification techniques. Here's a simple breakdown of what the query does:
Objective: The query aims to identify instances where a user is tricked into copying and pasting a malicious PowerShell command from a website, which then executes on their device.
Technique: The attack leverages a fake CAPTCHA or bot verification prompt to deceive users into executing a harmful script.
Detection Method:
The query looks for two types of events:
Clipboard Access: It checks for events where clipboard data is accessed by the "explorer.exe" process. This indicates that something was copied to the clipboard.
PowerShell Execution: It searches for PowerShell or mshta.exe processes that run commands containing "http" (indicating a web request) but not "http://localhost" (to exclude local testing), and where the command is hidden.
It then correlates these events by matching them on the same device and ensuring they occur within one minute of each other.
Output: The query lists devices where both clipboard access and suspicious PowerShell execution occur in close succession, suggesting a possible malicious activity.
Purpose: This helps security teams identify and respond to potential threats where users are tricked into executing harmful scripts, thereby enhancing the organization's cybersecurity posture.
Objective: The query aims to identify instances where a user is tricked into copying and pasting a malicious PowerShell command from a website, which then executes on their device.
Technique: The attack leverages a fake CAPTCHA or bot verification prompt to deceive users into executing a harmful script.
Detection Method:
The query looks for two types of events:
Clipboard Access: It checks for events where clipboard data is accessed by the "explorer.exe" process. This indicates that something was copied to the clipboard.
PowerShell Execution: It searches for PowerShell or mshta.exe processes that run commands containing "http" (indicating a web request) but not "http://localhost" (to exclude local testing), and where the command is hidden.
It then correlates these events by matching them on the same device and ensuring they occur within one minute of each other.
Output: The query lists devices where both clipboard access and suspicious PowerShell execution occur in close succession, suggesting a possible malicious activity.
Purpose: This helps security teams identify and respond to potential threats where users are tricked into executing harmful scripts, thereby enhancing the organization's cybersecurity posture.
This KQL query is designed to help analyze and triage incidents related to a tool called ClickFix. Here's a simple breakdown of what the query does:
Input Variables:
VictimDeviceId: The ID of the device that experienced the incident.
TopXEvents: The number of events to collect before and after a specific action.
TimeFrame: The time window around the action to consider for event collection.
Purpose:
The query is used to gather and analyze different types of events related to a potential security incident on a device. It focuses on events surrounding a suspicious registry change (specifically, the "RunMRU" registry key).
Data Collection:
Pre-Infection Network Events: Collects network events that occurred before the suspicious registry change, which might indicate the source of the infection.
RunMRU Event: Identifies the registry change event itself, which is a key indicator of compromise.
Post-Infection Network Events: Collects network events that occurred after the registry change, which might show further malicious activity.
Post-Infection Process Events: Collects process-related events that occurred after the registry change, indicating what processes might have been affected or initiated.
Post-Infection File Events: Collects file-related events that occurred after the registry change, showing any file modifications or creations.
Output:
The query outputs a sorted list of events, categorized by type (network, registry, process, file), to provide a comprehensive view of the incident timeline and help in understanding the scope and impact of the incident.
This query is useful for security analysts to quickly gather relevant information about a potential security incident and make informed decisions on how to respond.
Input Variables:
VictimDeviceId: The ID of the device that experienced the incident.
TopXEvents: The number of events to collect before and after a specific action.
TimeFrame: The time window around the action to consider for event collection.
Purpose:
The query is used to gather and analyze different types of events related to a potential security incident on a device. It focuses on events surrounding a suspicious registry change (specifically, the "RunMRU" registry key).
Data Collection:
Pre-Infection Network Events: Collects network events that occurred before the suspicious registry change, which might indicate the source of the infection.
RunMRU Event: Identifies the registry change event itself, which is a key indicator of compromise.
Post-Infection Network Events: Collects network events that occurred after the registry change, which might show further malicious activity.
Post-Infection Process Events: Collects process-related events that occurred after the registry change, indicating what processes might have been affected or initiated.
Post-Infection File Events: Collects file-related events that occurred after the registry change, showing any file modifications or creations.
Output:
The query outputs a sorted list of events, categorized by type (network, registry, process, file), to provide a comprehensive view of the incident timeline and help in understanding the scope and impact of the incident.
This query is useful for security analysts to quickly gather relevant information about a potential security incident and make informed decisions on how to respond.
This query is designed to detect a specific type of cyber attack known as the "ClickFix" attack, which was observed in February 2026. The attack involves using a social engineering technique where victims are tricked into running the nslookup command with a specific DNS server controlled by attackers. This malicious server then sends back a PowerShell script in the DNS response, which is executed to install malware like ModeloRAT.
Here's a simple breakdown of what the query does:
Data Source: It looks at security events, specifically those related to process creation (Event ID 4688).
Time Frame: The query checks for events that occurred in the last hour.
Process Monitoring: It focuses on instances where the nslookup.exe process is run.
Command Line Analysis: The query identifies nslookup commands that specify an explicit DNS server IP address, which is a key indicator of this attack. It uses specific patterns and regular expressions to find these commands.
Parent Process Check: It checks if the parent process of nslookup.exe is a shell or script interpreter like cmd.exe or powershell.exe, which is common in such attacks.
Output: The query projects details such as the time of the event, the computer involved, the user account, the command line used, and the parent process.
Alerting: If such an event is detected, it triggers an alert with a high severity level, providing details about the computer and account involved, and the command that was executed.
Entity Mapping: It maps the computer and account details to entities for better identification and tracking.
Alert Customization: The alert includes a custom message that highlights the nature of the attack and provides specific details about the command used.
Overall, this query is a security measure to detect and alert on potential ClickFix attacks by monitoring for suspicious nslookup usage patterns.
Here's a simple breakdown of what the query does:
Data Source: It looks at security events, specifically those related to process creation (Event ID 4688).
Time Frame: The query checks for events that occurred in the last hour.
Process Monitoring: It focuses on instances where the nslookup.exe process is run.
Command Line Analysis: The query identifies nslookup commands that specify an explicit DNS server IP address, which is a key indicator of this attack. It uses specific patterns and regular expressions to find these commands.
Parent Process Check: It checks if the parent process of nslookup.exe is a shell or script interpreter like cmd.exe or powershell.exe, which is common in such attacks.
Output: The query projects details such as the time of the event, the computer involved, the user account, the command line used, and the parent process.
Alerting: If such an event is detected, it triggers an alert with a high severity level, providing details about the computer and account involved, and the command that was executed.
Entity Mapping: It maps the computer and account details to entities for better identification and tracking.
Alert Customization: The alert includes a custom message that highlights the nature of the attack and provides specific details about the command used.
Overall, this query is a security measure to detect and alert on potential ClickFix attacks by monitoring for suspicious nslookup usage patterns.
This query is designed to detect potentially suspicious activity on a Windows device by examining the Windows registry for specific entries. Here's a simple breakdown of what it does:
Purpose: The query aims to identify suspicious entries in the Windows "RunMRU" registry key. This key keeps track of commands that have been executed via the Run dialog, and certain entries can indicate malicious activity.
Parameters and Executables: The query looks for specific patterns or keywords within these entries. It checks for certain parameters (like 'http', 'EncodedCommand', 'DownloadString', etc.) and executables (like 'cmd', 'powershell', 'curl', etc.) that are commonly associated with malicious scripts or commands.
Detection: If a registry entry contains any of the specified parameters and executables, it is flagged as suspicious. This could indicate that a potentially harmful command was executed on the device.
Output: The query outputs relevant details such as the timestamp, device ID, device name, the suspicious registry value data, and the registry key itself. This information helps in further investigation.
Risk: The query highlights a high likelihood that the detected command is deploying malicious content, making it a critical detection tool for security teams.
Overall, this query is a proactive measure to detect and respond to potential threats by monitoring specific registry changes that could indicate malicious activity.
Purpose: The query aims to identify suspicious entries in the Windows "RunMRU" registry key. This key keeps track of commands that have been executed via the Run dialog, and certain entries can indicate malicious activity.
Parameters and Executables: The query looks for specific patterns or keywords within these entries. It checks for certain parameters (like 'http', 'EncodedCommand', 'DownloadString', etc.) and executables (like 'cmd', 'powershell', 'curl', etc.) that are commonly associated with malicious scripts or commands.
Detection: If a registry entry contains any of the specified parameters and executables, it is flagged as suspicious. This could indicate that a potentially harmful command was executed on the device.
Output: The query outputs relevant details such as the timestamp, device ID, device name, the suspicious registry value data, and the registry key itself. This information helps in further investigation.
Risk: The query highlights a high likelihood that the detected command is deploying malicious content, making it a critical detection tool for security teams.
Overall, this query is a proactive measure to detect and respond to potential threats by monitoring specific registry changes that could indicate malicious activity.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
This query is designed to identify unusual executable files that are created in the C:\Users\Public directory and its subdirectories. This location is not typically used for storing executable files, so any files found here should be investigated as they might indicate malicious activity
This rule generates a comprehensive forensic timeline for a specific executable file, analyzing its origin (file creation/drops), execution context (process creation and child processes), network communications (outbound connections), and persistence mechanisms (registry modifications for run keys/startup and scheduled task creation/updates). It correlates events across different data sources based on the executable's file name or SHA256 hash.
This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Page 1 of 3