Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
20
10
3
1
1
Contributors
8
7
5
4
3
Categories
18
12
8
2
2
Platforms
34
2
Products / Services
9
9
5
3
2
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
1
IDS Protocols
1
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
This query was originally published in the threat analytics report, MailSniper Exchange attack tool.
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
'This composite hunting query will highlight any HTTP traffic in CommonSecurityLog web proxies (such as ZScaler) that match known patterns used by red teaming tools potentially stolen from FireEye. Most FireEye red teaming tools are designed to mimic
legitimate API activity, false positives are common. This query includes a basic check to determine how common a hostname is in you environment, and allows you to modify this threshold to remove legitimate traffic from the query results.
This query contains only a subset of potential FireEye red team tool communications, and therefore should not be relied upon alone :) .'
legitimate API activity, false positives are common. This query includes a basic check to determine how common a hostname is in you environment, and allows you to modify this threshold to remove legitimate traffic from the query results.
This query contains only a subset of potential FireEye red team tool communications, and therefore should not be relied upon alone :) .'
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This query checks for attempts to stop at least 10 separate processes using the net stop command. Run query
The analytic detects modifications to Windows Proxy settings via registry keys, specifically focusing on the path `*\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp*`. This activity is significant because `netsh.exe` can be used to establish a persistent proxy, potentially allowing an attacker to execute a helper DLL whenever `netsh.exe` runs. This could enable persistence, network configuration manipulation, data exfiltration, or further system compromise.
Detects the execution of netsh with the "add helper" flag to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy, getting called whenever netsh.exe is executed.
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Page 2 of 2