Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This analytic identifies a suspicious process that is recursively deleting executable files on a compromised host. It leverages Sysmon Event Codes 23 (File Delete) and 26 (File Delete logged) to detect this activity by monitoring for a high volume of deletions or overwrites of files with extensions like .exe, .sys, and .dll within a short timeframe. This behavior is significant as it is commonly associated with destructive malware such as CaddyWiper, DoubleZero, and SwiftSlicer, which aim to make file recovery impossible. If confirmed malicious, this activity could lead to significant data loss and system instability, severely impacting business operations.
Detects modifications to specific registry keys under `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). This includes keys related to Terminal Services, Security Providers, Safe Boot, Print Monitors/Providers, Network Provider Order, and LSA Authentication/Notification Packages. Such modifications can be indicative of persistence mechanisms used by adversaries.
Detects tampering of RDP Terminal Service/Server sensitive settings by monitoring modifications to specific registry keys. This includes changes that could allow unauthorized users access via 'fAllowUnsolicited', or enabling RDP via 'fDenyTSConnections' by setting their values to 'DWORD (0x00000000)'.
Detect modification of TreatAs key to enable "rundll32.exe -sta" command
Detects modifications to various Windows Registry keys under `CurrentVersion` that are commonly used for autostart extensibility points (ASEPs). This includes `Run`, `RunOnce`, `RunOnceEx`, `RunServices`, `RunServicesOnce`, `ShellServiceObjectDelayLoad`, `Policies\System\Shell`, `Policies\Explorer\Run`, `Group Policy\Scripts`, `Explorer\ShellServiceObjects`, `Explorer\ShellIconOverlayIdentifiers`, `Explorer\ShellExecuteHooks`, `Explorer\SharedTaskScheduler`, `Explorer\Browser Helper Objects`, `Authentication\PLAP Providers`, `Authentication\Credential Providers`, and `Authentication\Credential Provider Filters`. Adversaries often modify these keys to establish persistence on a system by ensuring their malicious code executes automatically during system boot or user logon.
Detects modifications to the 'User Shell Folders' registry key, specifically the 'Startup' value. This technique is often used by adversaries to establish persistence by ensuring a malicious payload is launched automatically when a user logs in.
Detects changes to the "DisableRestrictedAdmin" registry value, which controls RestrictedAdmin mode. Disabling RestrictedAdmin mode can expose credentials to compromise during Remote Desktop Protocol (RDP) connections, making it easier for adversaries to harvest credentials during lateral movement. This rule identifies modifications to this critical security setting.
Detects potential malicious modification of the 'UseLogonCredential' property value within the WDigest registry key to enable clear-text credential storage. This modification can allow attackers to dump credentials from LSASS memory.
This rule detects the creation or modification of Windows Registry Run keys that point to executable files located in suspicious folders. Adversaries often use Run keys for persistence, ensuring their malicious code executes automatically when a user logs in. The rule specifically looks for entries in common Run key paths (e.g., CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) where the associated executable's path is within directories commonly used by malware or temporary files (e.g., PerfLogs, ProgramData, Windows\Temp, AppData\Local\Temp, Recycle.Bin, Users\Default, Users\Public, or user profile subdirectories like Favorites, Music, Documents). A specific exclusion is included for legitimate Windows update processes that might write to temporary folders via RunOnce keys.
Detects modifications to specific registry keys under 'System\CurrentControlSet\Control\Session Manager' that are used for autostart extensibility points (ASEPs). These keys include 'SetupExecute', 'S0InitialCommand', 'KnownDLLs', 'Execute', 'BootExecute', and 'AppCertDLLs'. Adversaries often modify these keys to establish persistence or elevate privileges by ensuring their malicious code runs automatically during system boot or user login.
This rule detects attempts to establish persistence by modifying Windows Registry Run keys to execute PowerShell commands or scripts. It specifically looks for modifications to common Run key paths (CurrentVersion\Run, Wow6432Node\Microsoft\Windows\CurrentVersion\Run, Policies\Explorer\Run) that contain keywords indicative of PowerShell execution, such as 'powershell', 'pwsh', 'frombase64string', download functions, hidden window styles, no profile, encoded commands, execution policy bypass, and various Invoke- commands (Invoke-Expression, Invoke-Command, Invoke-WebRequest).
This rule detects attempts to clear the ShimCache (Application Compatibility Cache) on a Windows system. Adversaries may clear this cache to remove forensic evidence of executed programs. The rule specifically looks for `rundll32` executing `apphelp.dll` with `ShimFlushCache` or `#250`, or `rundll32` executing `kernel32.dll` with `BaseFlushAppCompatCache` or `#46`.
Detects the process injection activity of the malicious Havoc conhost.exe variant, specifically the creation of a remote thread within a cmd.exe process. This is a key step where the Havoc payload is injected and executed, as described by Fortinet.
'Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Ref: https://attack.mitre.org/techniques/T1546/008/'
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen. [1]
Ref: https://attack.mitre.org/techniques/T1546/008/'
Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.
Detects PowerShell creating a binary executable or a script file.
The following analytic detects potentially suspicious file copy operations targeting the System32 or SysWow64 directories as source, often indicative of malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on activity initiated by command-line tools like cmd.exe or PowerShell. This behavior is significant as it may indicate an attempt to evade defenses by copying an existing binary from the system directory and renaming it. If confirmed malicious, this activity could allow an attacker to execute code undetected and potentially leading to system compromise or further lateral movement within the network.
'Identifies a match across various data feeds for hashes and IP IOC related to Europium
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government'
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government'
'Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods
Page 385 of 465