Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
2
Contributors
2
2
Categories
1
1
1
1
1
Platforms
4
Products / Services
1
1
1
1
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
'This detection uses Security events from the "AD FS Auditing" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes.
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This activity is associated with the SNAKE malware, as reported by CISA, which uses this technique for persistence.