Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
59
33
9
3
3
Contributors
27
20
16
7
7
Categories
78
42
20
9
9
Platforms
100
9
5
2
1
Products / Services
34
28
15
4
4
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
This query generates process trees of given processes and performs anomaly detection on the process trees. It generates process trees up to 7th level.
The query can be used as a template to perform anomaly detection on specific processes like winword.exe, powerpnt.exe, w3wp.exe, etc. The query runs without any performance issues in large environments.
Detailed explanation can be found here
Reference - https://mergene.medium.com/detecting-threats-with-process-tree-analysis-without-machine-learning-838d85f78b2c
The query can be used as a template to perform anomaly detection on specific processes like winword.exe, powerpnt.exe, w3wp.exe, etc. The query runs without any performance issues in large environments.
Detailed explanation can be found here
Reference - https://mergene.medium.com/detecting-threats-with-process-tree-analysis-without-machine-learning-838d85f78b2c
This query identifies crashing processes based on parameters passed
to werfault.exe and attempts to find the associated process launch
from DeviceProcessEvents.
to werfault.exe and attempts to find the associated process launch
from DeviceProcessEvents.
'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time).
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
Backdoor processes associated with OceanLotus Mac malware backdoor dropper.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
References:.
Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/.
OS Platforms: Macintosh.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
This query checks for attempts to stop at least 10 separate processes using the taskkill.exe utility. Run query
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
Identifies suspicious child processes of SolarWinds.Orion.Core.BusinessLayer.dll that may be evidence of the SUNBURST backdoor
References:
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
References:
- https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
- https://gist.github.com/olafhartong/71ffdd4cab4b6acd5cbcd1a0691ff82f
These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
This is a completely stupid and pointless query that makes Vogon poetry out
of a random FolderPath from the table you pass it. You can change
DeviceProcessEvents for any table as long as it has a column named DeviceName
and a column called FolderPath. Feel free to check in more verses :)
Don't know what Vogon poetry is? You have a research assignment: http://tinyurl.com/y8ueqchl
of a random FolderPath from the table you pass it. You can change
DeviceProcessEvents for any table as long as it has a column named DeviceName
and a column called FolderPath. Feel free to check in more verses :)
Don't know what Vogon poetry is? You have a research assignment: http://tinyurl.com/y8ueqchl
These queries check telemetry from the Exploit Guard rule: Rule: Block Office applications from creating child processes.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
(Rule ID d4f940ab-401b-4efc-aadc-ad5f3c50688a).
Read more about it here: https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.
Oftentimes organizations enable this rule in audit mode and check the results before setting block mode.
You can use query #2 to measure the rule impact on your network in audit mode before turning it to block mode.
Query #1 is used after setting it to block mode - to analyze the block stats.
Tags: #ASR.
Query #1: block stats.
This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query
'Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This is intended to help use process exection information to discovery any systems that have SolarWinds processes'
Dopplepaymer In-Memory Malware Implant.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This rule detects attempts by known hacktool processes to access other processes. It specifically looks for 'PROCESS_OPEN' events where the principal process's image name matches a predefined list of hacktool patterns. This behavior is often indicative of credential dumping or other malicious activities where a tool needs to interact with another process's memory space, such as LSASS.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on logs containing process details and command-line executions. This activity is significant as it may indicate suspicious behavior, such as a user or process gathering detailed process information, which is uncommon for non-technical users. If confirmed malicious, this could allow an attacker to gain insights into running processes, aiding in further exploitation or lateral movement.
Page 4 of 6