Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
94 detections
Filters
Last updated
All Time
Detection languages
53
10
7
6
5
Contributors
25
24
12
6
4
Categories
24
23
22
21
20
Platforms
51
27
22
22
7
Products / Services
29
10
10
7
6
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
1
1
IDS Classtypes
5
3
1
1
IDS Protocols
4
3
2
1
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
This analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block Logging to capture and analyze script block text for specific WMI queries. This activity is significant as it is commonly used by malware and APT actors to map security applications or services on a compromised machine. If confirmed malicious, this could allow attackers to identify and potentially disable security defenses, facilitating further compromise and persistence within the environment.
'Any Alerts that fired on any host with this same process in the range of +-1d'
This query provides the most common services discovered
The following analytic identifies the execution of the dxdiag.exe process with specific command-line arguments, which is used to gather system information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line details. This activity is significant because dxdiag.exe is rarely used in corporate environments and its execution may indicate reconnaissance efforts by malicious actors. If confirmed malicious, this activity could allow attackers to collect detailed system information, aiding in further exploitation or lateral movement within the network.
Yara rule that detects MiyaRAT backdoor.
Identify the use of the GraphRunner recon command Invoke-GraphRecon with the permission enum flag set, providing allowed actions and conditional access data for the current user.
Yara rule that detects ChinaZ trojan.
This YARA rule detects the SideTwist backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include anti-sandbox detection, collection of host information, communication with a command and control (C2) server, parsing C2 responses, downloading files from the C2, and replying to the C2 server. The rule requires all these distinct patterns to be present within a PE file (identified by the 'MZ' header) to trigger a detection, aiming to minimize false positives.
Page 5 of 5