Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
'This query identifies matches based on KNOTWEED file hash IOCs across Microsoft Defender for Endpoint tables'
'This query looks for new files being downloaded using Curl.'
Dopplepaymer In-Memory Malware Implant.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This query identifies the launch pattern associated with wastedlocker ransomware.
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
Reference writeup: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_unidentified_nov_18.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability.
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from known file-sharing or content delivery network (CDN) websites. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
Detects possible command execution by a web application or web shell by monitoring `execve` and `execveat` syscalls initiated by the web server's user ID (e.g., euid 33 for www-data). This rule specifically targets Linux systems using auditd for logging, requiring a specific auditd configuration to capture these events.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
Detects suspicious child processes spawned by 'pc-app.exe', which is the main application executable for PaperCut MF/NG. The presence of common system utilities and scripting interpreters as child processes of 'pc-app.exe' can indicate successful exploitation of a vulnerability within PaperCut, potentially leading to arbitrary code execution.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
This rule detects when a process executes another process, and both the principal (parent) process's file hash and the target (child) process's file hash have known 'EXECUTES' relationships in VirusTotal. This indicates that VirusTotal has previously observed the parent process executing the child process, which could be a sign of malicious activity if the hashes are associated with known threats.
This rule detects the use of 'sc.exe' to query and enumerate services, specifically looking for the 'termservice'. Attackers often use 'sc.exe' to gather information about running services on a system, which can help them identify potential attack vectors or sensitive services. The detection focuses on the execution of 'sc.exe' with the 'query' command and the specific service 'termservice'.
Detects the execution of 'cmd.exe' specifically when initiated by the AnyViewer Remote Monitoring and Management (RMM) agent during a remote management session. This activity could indicate an adversary using the legitimate remote access tool to execute commands on a compromised system.
This rule monitors for attempts to write potentially malicious files into the C:\Windows\Fonts\ directory using command-line utilities. This folder is often targeted by adversaries because it typically does not require administrative privileges for writing and execution, making it a suitable location for defense evasion and persistence. The rule specifically looks for common command-line tools (like 'echo', 'copy', 'type', 'file createnew', 'cacls') combined with the target path 'C:\Windows\Fonts\' and various executable or script file extensions.
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects the initial execution pattern of the APT41 TOUGHPROGRESS malware via a malicious LNK file executing rundll32.exe with a specific command line argument as described in the Google Cloud blog.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Page 143 of 154