Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This query was originally published in the threat analytics report, Emulation-evading JavaScripts.
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects when Word or File Explorer have launched files with a .jse extension. Attackers involved in various human-operated campaigns have been known to embed a heavily obfuscated JavaScript file in malicious Word docs. The loader is used to download and install the banking trojan, Trickbot.
See Detect .jse file creation events for a similar technique.
Reference - https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects when Word or File Explorer have launched files with a .jse extension. Attackers involved in various human-operated campaigns have been known to embed a heavily obfuscated JavaScript file in malicious Word docs. The loader is used to download and install the banking trojan, Trickbot.
See Detect .jse file creation events for a similar technique.
Reference - https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
Cloud Hopper
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_cloudhopper.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query was originally published on Twitter, by @MsftSecIntel.
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
Gootkit is malware that started life as a banking trojan, and has since extended its capabilities to allow for a variety of malicious activities.
The query helps find events related to Gootkit downloads and command-and-control behavior.
Reference - https://twitter.com/MsftSecIntel
This rule detects suspicious PowerShell commands used to download files or content from the web. It specifically looks for the use of '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', or 'iwr' within the process command line. These methods are commonly abused by adversaries to retrieve malicious payloads or scripts.
This rule detects the execution of PowerShell commands that utilize the `System.Net.WebClient` object to download files using the `DownloadFile` method. This is a common technique used by adversaries to retrieve malicious payloads or tools from remote servers.
This rule detects suspicious execution of PowerShell's Invoke-WebRequest (or its aliases like 'iwr', 'curl', 'wget') when the output is directed to a suspicious location. Suspicious locations include common user directories like AppData, Desktop, Temp, Public, or the Windows directory, which are often abused by adversaries for dropping malicious files.
This rule detects the use of the '::FromBase64String(' function in a command line, which is a common method for decoding Base64 encoded strings in PowerShell. Adversaries often use Base64 encoding to obfuscate malicious commands or payloads, making them harder to detect by signature-based defenses. This detection aims to identify attempts to deobfuscate such encoded content, typically as part of a larger attack chain involving defense evasion and execution.
This rule detects the use of PowerShell to enumerate successful logon events (Event ID 4624) from the security event log on a Windows host. It specifically looks for command-line executions containing 'Get-EventLog', 'security', and '-instanceid 4624'. This activity is often performed during the reconnaissance phase by adversaries to understand user activity on a system.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Detects a renamed PowerShell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths. The rule specifically looks for PowerShell classic logs where the 'HostName' is 'ConsoleHost' but the 'HostApplication' field does not contain typical PowerShell executable paths or names, indicating a potential renaming or masquerading attempt.
This rule detects the creation of a domain group named "ESX Admins" using either `net.exe` or PowerShell cmdlets like `New-ADGroup`. This activity is highly suspicious and indicates a potential exploitation attempt of CVE-2024-37085. This vulnerability allows an attacker to elevate privileges to full administrative access on a domain-joined ESXi hypervisor, as VMware ESXi hypervisors grant full administrative access by default to members of a domain group named "ESX Admins".
This rule detects attempts to delete Windows Volume Shadow Copies using PowerShell commands that interact with WMI (Windows Management Instrumentation). Specifically, it looks for PowerShell scripts containing `Get-WmiObject`, `gwmi`, `Get-CimInstance`, or `gcim` in conjunction with `Win32_ShadowCopy` and a deletion method like `.Delete()`, `Remove-WmiObject`, `rwmi`, `Remove-CimInstance`, or `rcim`. This technique is commonly employed by ransomware families, such as Sodinokibi/REvil, to prevent system recovery.
Detects the execution and usage of the DSInternals PowerShell module. This module can be used to perform suspicious activities such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, recovering domain controllers from IFM backups, and calculating password hashes. The rule specifically looks for a wide range of cmdlets associated with the DSInternals module within PowerShell script block logs.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.
This analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as SharpHound is commonly used for Active Directory enumeration, which can be a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially compromising sensitive information and critical systems.
The analytic detects the use of .NET classes in PowerShell to download a URL payload directly into memory, a common fileless malware staging technique. It leverages PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell commands involving `system.net.webclient`, `system.net.webrequest`, and `IO.MemoryStream`. This activity is significant as it indicates potential fileless malware execution, which is harder to detect and can bypass traditional file-based defenses. If confirmed malicious, this technique could allow attackers to execute code in memory, evade detection, and maintain persistence in the environment.
The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because AzureHound is often used for reconnaissance in Azure environments, potentially exposing sensitive information. If confirmed malicious, this activity could allow an attacker to map out Azure Active Directory structures, aiding in further attacks and privilege escalation.
This analytic detects attempts to create an "ESX Admins" group using PowerShell commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the 'ESX Admins' group after its deletion from Active Directory.
The following analytic detects the use of curl on Linux or MacOS systems to download a file from a remote source and pipe it directly to bash for execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line arguments, and parent processes. This activity is significant as it is commonly associated with malicious actions such as coinminers and exploitation of vulnerabilities like CVE-2021-44228 in Log4j. If confirmed malicious, this behavior could lead to unauthorized code execution, system compromise, and further exploitation within the environment.
This analytic detects the use of `wget` to download a file from a remote source and pipe its content directly to `bash` for execution. This behavior is commonly associated with malicious activities such as deploying coinminers or exploiting vulnerabilities like CVE-2021-44228 (Log4j). Successful execution of such commands could lead to arbitrary code execution, system compromise, and unauthorized data access.
The analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. It leverages Endpoint Detection and Response (EDR) data, focusing on specific patterns in process paths. This activity is significant as it can indicate an attempt to bypass security controls and execute unauthorized code. If confirmed malicious, this behavior could lead to code execution, privilege escalation, or persistence within the environment, potentially allowing attackers to deploy malware or leverage other living-off-the-land binaries (LOLBins).
Page 175 of 191