Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
15
6
5
4
2
Contributors
21
5
4
2
2
Categories
20
17
15
15
4
Platforms
19
14
1
Products / Services
15
15
5
4
4
MITRE Techniques
18,184
15,755
12,677
8,491
6,305
CVEs
1
IDS Classtypes
15
IDS Protocols
15
This analytic detects DNS queries to domains associated with known remote access software such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This detection is crucial as adversaries often use these tools to maintain access and control over compromised environments. Identifying such behavior is vital for a Security Operations Center (SOC) because unauthorized remote access can lead to data breaches, ransomware attacks, and other severe impacts if these threats are not mitigated promptly.
This analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer, as identified by Cisco Secure Firewall Application Detectors. It leverages Cisco Secure Firewall Threat Defense Connection Events. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects the Emotet Epoch4 loader as reported by @malware_traffic in 2022. This specific detection focuses on the execution chain involving a .LNK file delivered via a phishing campaign, which then uses `cmd.exe` or `powershell.exe` to execute commands containing `findstr`, `.vbs`, and `.lnk` in the command line. This indicates an attempt to locate and execute a VBScript from within the LNK file context, a common technique for malware like Emotet to achieve initial execution.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
This query was originally published in the threat analytics report, Emulation-evading JavaScripts.
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files.
See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Attackers in several ransomware campaigns have employed heavily obfuscated JavaScript code, in order to implant malware or execute malicious commands. The obfuscation is intended to help the code evade security systems and potentially escape sandbox environments.
The following query detects the creation of files with a .jse extension. Certain ransomware campaigns, such as Emotet, are known to employ encrypted JavaScript code that is saved to the target as .jse files.
See Detect potentially malicious .jse launch by File Explorer or Word for a similar technique.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
This analytic detects emails containing attachments with suspicious file extensions. It leverages the Email data model in Splunk, using the tstats command to identify emails where the attachment filename is not empty. This detection is significant for SOC analysts as it highlights potential phishing or malware delivery attempts, which are common vectors for data breaches and malware infections. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, system compromise, or data exfiltration. Immediate review and analysis of the identified emails and attachments are crucial to mitigate these risks.
The analytic detects spikes in Server Message Block (SMB) traffic connections, which are used for sharing files and resources between computers. It leverages network traffic logs to monitor connections on ports 139 and 445, and SMB application usage. By calculating the average and standard deviation of SMB connections over the past 70 minutes, it identifies sources exceeding two standard deviations from the average. This activity is significant as it may indicate potential SMB-based attacks, such as ransomware or data theft. If confirmed malicious, attackers could exfiltrate data or spread malware within the network.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
This rule detects potential Emotet malware activity by monitoring the creation of `rundll32.exe` processes. Specifically, it looks for `rundll32.exe` command lines that end with `,RunDLL` or `,Control_RunDLL`, which are common patterns used by Emotet for DLL loading. The rule includes filters to reduce false positives from legitimate DLL executions and specific development environment scenarios.
This rule detects suspicious PowerShell process creations that include base64 encoded commands. It looks for PowerShell or pwsh executables being launched with the '-e', '-en', or '-enc' command-line arguments, combined with specific base64 encoded strings commonly associated with malicious activity (e.g., ' JAB', ' SUVYI', ' SQBFAFgA', ' aQBlAHgA', ' aWV4I', ' IAA', ' IAB', ' UwB', ' cwB'). It also includes a standalone detection for '.exe -ENCOD ' and ' BA^J e-' (reversed). This pattern is often used by malware like Emotet to obfuscate their command-and-control instructions or payloads.
This YARA rule detects various versions of the Emotet trojan by identifying specific byte patterns (hexadecimal sequences) associated with its resource decryption and filename generation routines, as well as its use of the liblzf decompression algorithm and state machine snippets. The rule looks for combinations of these patterns within executable files (indicated by the 'MZ' header).
Yara rule that detects Emotet trojan.
Page 2 of 2