Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
16
8
5
3
1
Contributors
6
6
5
4
3
Categories
15
5
5
4
4
Platforms
26
5
4
3
1
Products / Services
9
8
5
4
2
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
IDS Classtypes
5
IDS Protocols
5
Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
Detects the creation or setting of the specific environment variable 'ALLUSERSPROFILE_X'. This variable is used as a mandatory execution gate by a malware campaign delivering Amatera Stealer to ensure that the initial user-assisted execution step was completed.
Detects a process launching from a common user-writable directory that subsequently makes an external network connection. This behavior is consistent with malware, such as the Mythic agent used by RomCom, that performs an execution guardrail check (e.g., verifying the host's domain name) before initiating command and control communications.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
KQL Query
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
'Shows the rarest processes seen running for the first time. (Performs best over longer time ranges - eg 3+ days rather than 24 hours!)
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
These new processes could be benign new programs installed on hosts;
However, especially in normally stable environments, these new processes could provide an indication of an unauthorized/malicious binary that has been installed and run.
Reviewing the wider context of the logon sessions in which these binaries ran can provide a good starting point for identifying possible attacks.'
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files.
The query below surfaces commands that follow the distinctive pattern Cypherpunk operators would use to remotely execute code.
'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time).
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
This helps us identify rare processes on a given Host. Rare here means a process shows up on the Host relatively few times in the the last 7days.
The Weight is calculated based on the Entropy, Process Count and Distinct Hosts with that Process. The lower the Weight/ProcessEntropy the, more interesting.
The Weight calculation increases the Weight if the process executes more than once on the Host or has executed on more than 1 Hosts.
In general, this should identify processes on a Host that are rare and rare for the environment.
References: https://medium.com/udacity/shannon-entropy-information-gain-and-picking-balls-from-buckets-5810d35d54b4
https://en.wiktionary.org/wiki/Shannon_entropy'
Query for Microsoft Defender Antivirus detections.
Query #1: Query for Antivirus detection events.
Query #1: Query for Antivirus detection events.
Page 2 of 2