Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root.
This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
CVE: CVE-2022-22960.
Read more here:.
https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Tags: #exploit #CVE-2022-22960
This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
CVE: CVE-2022-22960.
Read more here:.
https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Tags: #exploit #CVE-2022-22960
'This query looks for Microsoft Defender for Endpoint detections related to the remote command execution attempts on Azure IR with Managed VNet or SHIR.
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
In Microsoft Sentinel, the SecurityAlerts table includes the name of the impacted device. Additionally, this query joins the DeviceInfo table to connect other information such as device group, IP address, signed in users, and others allowing analysts using Microsoft Sentinel to have more context related to the alert.
Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29972 ,
https://msrc-blog.microsoft.com/2022/05/09/vulnerability-mitigated-in-the-third-party-data-connector-used-in-azure-synapse-pipelines-and-azure-data-factory-cve-2022-29972'
This query was originally published in the threat analytics report, Msiexec abuse.
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
Msiexec.exe is a Windows component that installs files with the .msi extension. These kinds of files are Windows installer packages, and are used by a wide array of legitimate software. However, malicious actors can re-purpose msiexec.exe for living-off-the-land attacks, where they use legitimate system binaries on the compromised device to perform attacks.
The following query detects activity associated with misuse of msiexec.exe, particularly alongside mimikatz, a common credential dumper and privilege escalation tool.
Reference - https://www.varonis.com/blog/what-is-mimikatz/
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
c2-bluekeep
KQL
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices that have communicated with attacker infrastructure associated with BlueKeep-related cryptomining.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
Following the September 14th, 2021 release of three Elevation of Privilege (EoP) vulnerabilities (CVE-2021-38645, CVE-2021-38649, CVE-2021-38648) and one unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-38647) in the Open Management Infrastructure (OMI) Framework.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
This detection validates that any OMS-agent that is reporting to the Microsoft Sentinel workspace is updated with the patch. The detection will go over the heartbeats received from all agents over the last day and will create alert for those agents who are not updated.
'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
This query was originally published in the threat analytics report, Confluence and WebLogic abuse.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query detects devices with RDP connections that could be exploitation attempts.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query detects devices with RDP connections that could be exploitation attempts.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
'This query looks for suspicious request patterns to Exchange servers that fit patterns recently blogged about by PeterJson. This exploitation chain utilises an SSRF vulnerability in Exchange which eventually allows the attacker to execute arbitrary Powershell on the server.
In the example powershell can be used to write an email to disk with an encoded attachment containing a shell.
Reference: https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1'
In the example powershell can be used to write an email to disk with an encoded attachment containing a shell.
Reference: https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1'
This query detects possible abuse of ms-msdt MSProtocol URI scheme to load and execute malicious code via Microsoft Support Diagnostic Tool Vulnerability (CVE-2022-30190).
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
The following query detects when Microsoft Office software spawns an instance of the MSDT utility, msdt.exe.
References:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://attack.mitre.org/techniques/T1221/
The following query surface network activity associated with exploitation of CVE-2022-22965.
Assuming that you have a machine that is properly BitLocker'ed, then
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
the machine will need to be running to extract the SAM and SYSTEM
files.
This first query looks for any access to the HKLM that happens via a command
or script that is not executed by system.
The second query looks for usage of reg or regedit by anyone who is not system.
This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
This query was originally published in the threat analytics report, ALPC local privilege elevation.
Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system.
This vulnerability was patched in the September 2018 Security Update.
The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8440
https://support.microsoft.com/help/4457143/windows-81-update-kb4457143
Windows ALPC Elevation of Privilege Vulnerability, CVE-2018-8440, could be exploited to run arbitrary code or to gain access to protected directories and areas of the operating system.
This vulnerability was patched in the September 2018 Security Update.
The following query checks for potential activity related to this vulnerability over the past 7 days. If you wish to check another time period, update the EventTime value.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8440
https://support.microsoft.com/help/4457143/windows-81-update-kb4457143
This query was originally published in the threat analytics report, Exploitation of CVE-2019-0708 (BlueKeep).
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices where the known coin miner payload was dropped.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
CVE-2019-0708, also known as BlueKeep, is a critical remote code execution vulnerability involving RDP. Soon after its disclosure, the NSA issued a rare advisory about this vulnerability, out of concern that it could be used to quickly spread malware. Attackers have since used this vulnerability to install cryptocurrency miners on targets.
Microsoft has issued updates for this vulnerability, as well as guidance for protecting operating systems that we no longer support. Microsoft Defender ATP also contains behavioral detections for defending against this threat.
The following query locates devices where the known coin miner payload was dropped.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0708
https://www.nsa.gov/News-Features/News-Stories/Article-View/Article/1865726/nsa-cybersecurity-advisory-patch-remote-desktop-services-on-legacy-versions-of/
https://www.wired.com/story/bluekeep-hacking-cryptocurrency-mining/
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0708
https://support.microsoft.com/help/4500705/customer-guidance-for-cve-2019-0708
https://www.microsoft.com/security/blog/2019/11/07/the-new-cve-2019-0708-rdp-exploit-attacks-explained/
The query digs in Windows print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder.
This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Suspicious DLL is load from Spooler Service backup folder.
This behavior is used from PoC Exploit of CVE-2021-34527, CVE-2021-1675 or CVE-2022-21999.
The following query detects possible CVE-2021-42278 exploitation by finding changes of device names in the network using Microsoft Defender for Identity
Page 142 of 159