Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This query helps reviewing email malware detection cases
This query was originally published in a threat analytics report about the group known to other security researchers as APT32 or OceanLotus
This tracked activity group uses a wide array of malicious documents to conduct attacks. Some of their favorite techniques include sideloading dynamic link libraries, and disguising payloads as image files. The group has weaponized files with exploits for the following vulnerabilities:
1. CVE-2017-11882 - Software update
2. CVE-2017-0199 - Software update
The following query detects known malicious files associated with the group's campaigns.
See Detect malicious network activity associated with group known as "OceanLotus" for another query related to this group's activity.
This tracked activity group uses a wide array of malicious documents to conduct attacks. Some of their favorite techniques include sideloading dynamic link libraries, and disguising payloads as image files. The group has weaponized files with exploits for the following vulnerabilities:
1. CVE-2017-11882 - Software update
2. CVE-2017-0199 - Software update
The following query detects known malicious files associated with the group's campaigns.
See Detect malicious network activity associated with group known as "OceanLotus" for another query related to this group's activity.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
'This query identifies matches based on KNOTWEED file hash IOCs across Microsoft Defender for Endpoint tables'
Get stats on ASR audit events - count events and machines per rule.
Query for SmartScreen URL blocks, where the user has decided to run the malware nontheless.
An additional optional filter is applied to query only for cases where Microsoft Edge has downloaded a file shortly after the ignored block.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
An additional optional filter is applied to query only for cases where Microsoft Edge has downloaded a file shortly after the ignored block.
Read more about SmartScreen here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.
Data availability: These events are available only on Windows 10 version 1703 and onwards.
Tags: #SmartScreen.
This query was originally published in the threat analytics report, Windows 7 zero-day for CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
CVE-2019-0808 is a vulnerability that allows an attacker to escape the Windows security sandbox and run arbitrary code with admin privileges. This vulnerability affects Windows 7, Windows Server 2008, and Windows Server 2008 R2.
Exploits for CVE-2019-0808 were first observed as part of highly selective attacks using the Nufsys backdoor. Although the Nufsys-associated exploit was first described as a zero-day, the issue has since been patched.
The following query detects possible CVE-2019-0808 exploitation by finding suspicious file creation events associated with Nufsys.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-0808
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2019-0808
This query was originally published on Twitter, by @MsftSecIntel.
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
Total Controlled Folder Access events.
This query helps reviewing malware detections by detection methods
Detects potential CSharp Streamer RAT loading a .NET executable image by identifying a specific file name pattern and path commonly associated with the tool. This rule looks for image loads from a temporary directory with a filename matching 'dat[0-9A-Z]{4}\.tmp'.
Detects potential Java webshell uploads to an SAP NetViewer server via HTTP POST requests with a 'Content-Type' of 'application/octet-stream' and URI stems containing '/irj/' and ending with '.jsp', '.class', or '.java'. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells.
Detects the download of Ursnif malware based on specific URL patterns and a successful HTTP status code. The rule looks for URIs containing a forward slash, '.php?l=', and ending with '.cab', combined with an HTTP status code of 200, indicating a successful download.
The analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
The analytic detects the creation of suspicious registry entries by Qakbot malware. These entries are characterized by 8 random hexadecimal registry value names with encrypted binary data, typically found under the "SOFTWARE\\Microsoft\\" path. The detection focuses on processes like explorer.exe, wermgr.exe, dxdiag.exe, OneDriveSetup.exe, mobsync.exe, msra.exe, and xwizard.exe making these modifications. This activity is a strong indicator of a Qakbot infection, as the malware uses the registry to store malicious code or configuration data, enabling persistence and arbitrary code execution on compromised systems.
This YARA rule detects the VanHelsing ransomware based on specific byte patterns associated with its file encryption routines, network enumeration capabilities, shadow copy deletion, and ransomware note dropping. The rule includes two main versions of the ransomware's functionality, indicating potential evolution or different variants.
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
Endpoint Health with AV information
Find endpoints ASR Rules blocking
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
Page 198 of 232