Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
841 detections
Filters
Last updated
All Time
Detection languages
353
266
53
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
163
108
Platforms
826
12
5
3
3
Products / Services
275
213
176
129
40
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
841
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the creation of a new service using powershell.
Detects the creation of a new service using the "sc.exe" utility.
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects the load of known vulnerable drivers via the file name of the drivers.
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
Detects the creation of a new service using powershell.
Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
OilRig APT Activity
Sigma
Detects OilRig activity as reported by Nyotron in their March 2018 report
Detects the load of known vulnerable drivers via their names only.
Detects creation of a new service (kernel driver) with the type "kernel"
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.
Detects the load of a signed and vulnerable GIGABYTE driver often used by threat actors or malware for privilege escalation
Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors
Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked.
However, it could still be useful to have a more human-friendly description in the results.
Also, this query is a good example for how you could define your own lookup tables and join with them.
The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule.
This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.
This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description.
This query shows the ability to use joins and custom dimension tables.
See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax.
For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email.
First lets start by creating a table of the rule descriptions to rule guids.
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report
Page 35 of 41