Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
10
8
7
3
3
Contributors
5
4
4
3
3
Categories
13
10
7
7
7
Platforms
21
7
5
4
1
Products / Services
6
6
3
3
3
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
1
IDS Classtypes
3
IDS Protocols
3
Detects a PowerShell command used to read its own batch script container (e.g., rEgX.cmd) to find and extract a hidden, encoded payload. This self-parsing technique is a core feature of the Dead#Vax malware.
Detects attempts to execute the 'dsmain' utility with specific flags (-e, -d, -g) used by RESURGE for AES encryption/decryption of the coreboot RAM disk or to extract the vmlinux kernel image on Ivanti Connect Secure devices.
Detects modifications to the Text Input Processor (TIP) registry key with unusually large binary data, which can be indicative of malware hiding persistent code. This specific registry key is not commonly used for storing large amounts of data, making large writes suspicious.
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
KQL Query
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
This query was originally published in the threat analytics report, "Exchange Server zero-days exploited in the wild".
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query finds evidence of Base64-encoded commands used by the Nishang penetration testing framework to load a reverse TCP shell. This might indicate an attacker has remote access to the device.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
In early March 2021, Microsoft released patches for four different zero-day vulnerabilities affecting Microsoft Exchange Server. The vulnerabilities were being used in a coordinated attack. For more information on the vulnerabilities, visit the following links:
1. CVE-2021-26855
2. CVE-2021-26857
3. CVE-2021-26858
4. CVE-2021-27065
The following query finds evidence of Base64-encoded commands used by the Nishang penetration testing framework to load a reverse TCP shell. This might indicate an attacker has remote access to the device.
More queries related to this threat can be found under the See also section of this page.
Reference - https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server/
The query helps detect emails associated with the open redirector URL campaign using Defender for Office 365 data.
This rule detects network connections initiated by a file whose SHA256 hash is known, via VirusTotal relationships, to contact a specific IP address. It correlates network connection events with VirusTotal intelligence to identify potentially malicious communication.
This rule detects the use of 'dd' and 'truncate' commands to add junk data to a file, a technique adversaries may employ for binary padding to evade detection. Specifically, it looks for 'truncate' with the '-s' (size) option or 'dd' with 'if=' (input file) but without 'of=' (output file), indicating potential in-place modification or padding.
This rule detects the use of 'dd' and 'truncate' utilities to add junk data to a file, a technique known as binary padding. Adversaries may use this method to alter the on-disk representation of malware, potentially bypassing security tools that have file size limitations or rely on hash-based detection.
Page 2 of 2