Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious
Detects potential CommandLine obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects Obfuscated use of Environment Variables to execute PowerShell
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Detects base64 encoded powershell cmdlet invocation of known suspicious cmdlets
Detects usage of "xor" or "bxor" in combination of a "foreach" loop. This pattern is often found in encoded powershell code and commands as a way to avoid detection
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Run from a Zip File
Sigma
Payloads may be compressed, archived, or encrypted in order to avoid detection
Detects a service installation that uses a suspicious double ampersand used in the image path value
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects commands used by Turla group as reported by ESET in May 2020
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated use of Clip.exe to execute PowerShell
Detects suspicious encoded character syntax often used for defense evasion
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects specific combinations of encoding methods in PowerShell via the commandline
Page 71 of 81