davidgodwinpratt.com / soc

Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.

This query was originally published in the threat analytics report, Sysrv botnet evolution. Sysrv is a Go-based botnet that targets both Windows and Linux servers, and steals resources to mine cryptoc

Aria SBox 2

Look for Base64 table

BigDig bpInit

BigDig mpModExp

BigDig mpModInv

BigDig mpModMult

BigDig mpModulo

BigDig spModExpB

BigDig spModInv

BigDig spModMult

Look for 128-bit key Chacha stream cipher constant

Look for 256-bit key Chacha stream cipher constant

CryptoPP ApplyFunction

CryptoPP Integer constructor

CryptoPP RsaFunction

Look for DCP Blowfish EncryptCBC

Look for DCP Blowfish Init

Look for DCP Des EncryptECB

Look for DCP Des Init

Look for DCP RijnDael EncryptECB

Look for DCP RijnDael Init

Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization

Look for Compare string function

Look for Copy function

Look for DecodeDate (DecodeDateFully) function

Look for Form.Show function

Look for IntToStr function

Look for Random function

Look for RandomRange function

Look for StrToInt function

Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.

Prior to deploying Macaw ransomware in an organization, the adversary will disable all controlled folders, which will enable them to be encrypted once the ransomware payload is deployed.

Dopplepaymer In-Memory Malware Implant. This query identifies processes with command line launch strings. Which match the pattern used in Dopplepaymer ransomware attacks.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_dragonfly.yml. Questions via Twitter: @janvonkirchheim.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_elise.yml. Questions via Twitter: @janvonkirchheim.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_equationgroup_c2.yml. Questions via Twitter: @janvonkirchheim.

Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization

This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query

Use this query to find Excel launching anomalous processes congruent with Qakbot payloads which contain additional markers from recent Qakbot executions. The presence of such anomalous processes indic

FGint RsaSign

Use this query to find attempts to access files in the local path containing Outlook emails.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_hurricane_panda.yml. Questions via Twitter: @janvonkirchheim.

The following query can locate activity possibly associated with the EUROPIUM threat actor

This query looks for Microsoft Defender Antivirus detections related to EUROPIUM actor

This query looks for identity add through exchange PowerShell

Directly prior to deploying Macaw ransomware in an organization, the attacker will run several commands designed to disable security tools and system recovery tools.

Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_judgement_panda_gtr19.yml. Questions via Twitter: @janvonkirchheim.

'This query looks for Microsoft Defender Antivirus detections with the family names used by KNOTWEED'

'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'

'This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections'

'This query looks for new files being downloaded using Curl.'

'This query identifies matches based on KNOTWEED file hash IOCs across Microsoft Defender for Endpoint tables'

'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavi

LockBox DecryptRsaEx

LockBox EncryptRsaEx

LockBox RsaEncryptFile

LockBox TlbRsaKey

Backdoor processes associated with OceanLotus Mac Malware Backdoor. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS platform

Backdoor processes associated with OceanLotus Mac malware backdoor dropper. References:. Https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/. OS

Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery effort

Miracl Big constructor

Miracl mirsys init

Miracl mirvar

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_oceanlotus_registry.yml. Questions via Twitter: @janvonkirchheim.

OpenSSL BN_mod_exp_inverse

OpenSSL BN_mod_exp_mont

OpenSSL BN_mod_exp_recp

OpenSSL BN_mod_exp_simple

OpenSSL BN_mod_exp2_mont

YARA rule: OpenSSL_DSA

YARA rule: pkcs8_private_key_information_syntax_standard

Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.

Qakbot operators have been abusing the Craigslist messaging system to send malicious emails. These emails contain non-clickable links to malicious domains impersonating Craigslist, which the user is i

Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions. Email theft that occurs might be exfiltrated to operators and indi

Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions. Email theft that occurs might be exfiltrated to operators and indi

Use this query to find reconnaissance and beaconing activities after code injection occurs. Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltr

Find use of Alternate Data Streams (ADS) for anti-forensic purposes. Alternate Data Streams execution.

Adversaries are likely attempting to delete backup files in healthcare environments to eliminate recovery options

// Look for cipher.exe deleting data from multiple drives. This is often performed as an anti-forensic measure prior to encryption.

// Look for attempts to use fsutil.exe to delete file system logs that can be used as forensic artifacts.

Identify accounts that have logged on to affected endpoints. Check for specific alerts.

Find distinct evasion and execution activities. Associated with the Robbinhood ransomware campaign.

Find attempts to stop System Restore and. Prevent the system from creating restore points.

Locate vulnerable Gigabyte drivers used by RobbinHood ransomware to turn off security tools.

RijnDael AES

RijnDael AES (check2) [char]

RijnDael AES S-inv [char]

RsaEuro NN_modInv

RsaEuro NN_modMult

RsaRef2 NN_modExp

RsaRef2 NN_modInv

RsaRef2 NN_modMult

RsaRef2 RsaPrivateDecrypt

RsaRef2 RsaPrivateEncrypt

RsaRef2 RsaPublicDecrypt

RsaRef2 RsaPublicEncrypt

'This query identifies matches based on domain IOCs related to Star Blizzard against Microsoft Defender for Endpoint device network connections'

StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the

StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the

StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the

Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization

Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.

Attackers may use unconventional PowerShell curl flags

Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing the ws_TomcatService.exe process to launch malicious processes.

Hunt package for 95 IOCs associated with ClearFake

Hunt package for 3 IOCs associated with KongTuke

Hunt package for 8 IOCs associated with SmartApeSG

Hunt package for 100 IOCs associated with Unknown malware

Hunt package for 5 IOCs associated with Unknown RAT

Hunt package for 3 IOCs associated with Amadey

Hunt package for 6 IOCs associated with Cobalt Strike

Hunt package for 2 IOCs associated with Lumma Stealer

Hunt package for 5 IOCs associated with Nanocore RAT

Hunt package for 9 IOCs associated with Remcos

The Stealc malware is a data exfiltration tool designed to steal sensitive information such as credentials and system data from infected hosts. It typically arrives via phishing emails or malicious websites containing malicious URLs that download and execute the payload. SOC analysts should monitor for unusual outbound traffic patterns, unexpected data transfers, and signs of lateral movement or command-and-control communication beyond the identified URLs.

Hunt package for 2 IOCs associated with ValleyRAT

Hunt package for 4 IOCs associated with Vidar

Look for Random function

Hunt package for 17 malicious URLs tagged as 32-bit

Hunt package for 8 malicious URLs tagged as arm

Hunt package for 51 malicious URLs tagged as ClearFake

Hunt package for 18 malicious URLs tagged as elf

Hunt package for 3 malicious URLs tagged as malware_download

Hunt package for 4 malicious URLs tagged as mirai

Hunt package for 2 malicious URLs tagged as Mozi

Hunt package for 12 malicious URLs tagged as ua-wget

Prior to deploying Macaw ransomware in an organization, the adversary frequently uses MSBuild.exe as a LOLBin to communicate with the C2.

Look for Random function

Look for Random function

YARA rule: x509_public_key_infrastructure_cert

This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using t

This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using t

Sample query that search for .settingcontent-ms that has been downloaded from the web. Through Microsoft Edge, Internet Explorer, Google Chrome, Mozilla Firefox, Microsoft Outlook. For questions @Mila

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml. Questions via Twitter: @janvonkirchheim.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_apt29_thinktanks.yml. Questions via Twitter: @janvonkirchheim.

Bazacall malware uses emails that contain a phone number for the user to call in order to cancel a fake subscription. These emails contain no links or attachments, and use automatic payment lures to t

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_bear_activity_gtr19.yml. Questions via Twitter: @janvonkirchheim.

Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_cloudhopper.yml. Questions via Twitter: @janvonkirchheim.

Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.

DES [long]

DES [pbox] [long]

DES [sbox]

This is a query to retrieve last 30 days network connections to known Dofoil NameCoin servers. The full article is available here: https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-d

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Ex

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Ex

Bazacall uses malicious macro-enabled Excel documents to execute their payload.

FGint Base256StringToGInt

FGint ConvertBase256StringToHexString

FGint ConvertBase256to64

FGint ConvertHexStringToBase256String

FGint DSAPrimeSearch

FGint DSASign

FGint DSAVerify

FGint ECAddPoints

FGint ECElGamalEncrypt

FGint ECPointDestroy

FGint ECPointKMultiple

FGint FGIntToBase256String

FGint FindPrimeGoodCurveAndPoint

FGint PGPConvertBase256to64

FGint RsaDecrypt

FGint RSAEncrypt

FGint RSAVerify

Bazacall uses malicious Excel files to execute payloads on affected devices.

Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.

Microsoft has observed Bazacall using a renamed version of Rclone for data exfiltration.

During the chain of events from Bazacall to Bazaloader, RunDLL makes several network connections, including to command and control (C2) infrastructure. The command line for these connections contains

The "Stolen Images" Bazarloader campaign uses fake copyright infingement contact form emails and malicious files pretending to contain "stolen images" to trick users into downloading the malware.

Hunt package for 103 IOCs associated with ClearFake

Hunt package for 7 IOCs associated with KongTuke

Hunt package for 6 IOCs associated with Unknown malware

Hunt package for 2 IOCs associated with Lumma Stealer

Hunt package for 6 IOCs associated with Nanocore RAT

Quasar RAT is

StrelaStealer is a credential-stealing malware that exfiltrates sensitive data, including passwords and browser cookies, by establishing covert communication with command-and-control servers. It typically arrives via phishing emails containing malicious links or compromised websites that deploy the malware through exploit kits or malicious attachments. SOC analysts should monitor for lateral movement indicators, unusual outbound traffic patterns

Hunt package for 16 IOCs associated with Vidar

Hunt package for 47 malicious URLs tagged as 32-bit

ClearFake is a malware family that primarily functions as a data exfiltration tool, leveraging command-and-control (C2) communication to

Hunt package for 3 malicious URLs tagged as malware_download

The Mozi malware family is a downloader that establishes command-and-control (C2) communication to exfiltrate data and deploy additional payloads. It typically arrives via phishing emails or malicious websites leveraging

In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file.

The pw protected zip attachment -> Word doc delivery method of Bazarloader utilizes Word to create an .hta file and launch it via MSHTA to connect to a malicious domain and pull down the Bazarloader p

This query offers daily categorization of ASR rules, helping SOC analysts monitor specific categories like office-related activities or WMI among the 16 rules. It aids in tracking detection rates and

'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx(). This query tries to list executed KQL queries that use

'This hunting query looks for increases in the number of workspaces queried by a user.'

CryptoPP a_exp_b_mod_c

CryptoPP modulo

FGint Base10StringToGInt

FGint FGIntDivMod

FGint FGIntDestroy

FGint FGIntModExp

FGint MontgomeryModExp

FGint MulByInt

'This hunting query identifies GitHub activites its the first time a user deleted a repo that may be a sign of compromise.'

'This hunting query identifies Accounts that are new or inactive and have accessed or used GitHub that may be a sign of compromise.'

'This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.'

'This hunting query identifies GitHub OAuth Apps that have restrictions disabled that may be a sign of compromise. Attacker will want to disable such security tools in order to go undetected. '

'Attacker can exfiltrate data from your GitHub repository by cloning it. This hunting query tracks clone activities for each repository, allowing quick identification of anomalies/excessive clones to

Adversaries may exploit GitHub's public access to exfiltrate sensitive data or distribute malicious code by converting private repositories to public, leveraging the platform's visibility for covert operations. SOC teams should proactively

'This hunting query identifies GitHub activites where permissions are updated that may be a sign of compromise.'

'This hunting query identifies Accounts in GitHub that have granted access to another account which then grants access to yet another account that may be a sign of compromise.'

Looks for MD5 API

Look for MD5 constants

Miracl crt

Miracl powmod

'This hunting query looks for users who are running multiple queries that return either a very large amount of data or the maximum amount allowed by the query method.'

'This hunting query looks for clients running queries that have not previously been seen running queries.'

'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'

'This hunting query looks for users who have run queries calling a watchlist template relating to sensitive data that have not previously been seen calling these watchlists.'

'This hunting query looks for users who have run queries that have not previously been seen running queries.'

'This hunting query looks for anomalously large LA queries by users.'

'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'

The RC6_Constants rule detects binaries containing RC6 encryption constants, which may indicate malicious activity leveraging the RC6 cipher.

Look for RIPEMD-160 constants

Look for SHA1 constants

Look for SHA2/BLAKE2/Argon2 IVs

Look for SHA384/SHA512 constants

Look for TEA Encryption

Hunt package for 3 IOCs associated with Kimwolf

The Mirai malware family compromises IoT devices by exploiting default credentials and weak security configurations, turning them into bots for large-scale DDoS attacks. It typically arrives via network exploitation, leveraging un

Hunt package for 77 IOCs associated with ClearFake

Hunt package for 2 IOCs associated with FAKEUPDATES

The KongTuke malware is a data exfiltration tool that establishes

Hunt package for 36 IOCs associated with Unknown malware

The Havoc malware family is designed for data exfiltration and persistence, often leveraging encrypted communication channels to steal sensitive

Hunt package for 20 IOCs associated with Lumma Stealer

Hunt package for 7 IOCs associated with Quasar RAT

StrelaStealer is a credential-stealing malware that exfiltrates sensitive data such as usernames,

Hunt package for 3 IOCs associated with ValleyRAT

Vidar is a data exfiltration malware

The "32-bit" malware

Hunt package for 38 malicious URLs tagged as ClearFake

Hunt package for 3 malicious URLs tagged as malware_download

Hunt package for 9 malicious URLs tagged as Mozi

'This hunting query looks for users whose total returned data that is significantly above their average.'

'This hunting query looks for users who have multiple failed queries in a short space of time.'

Look for WhirlPool constants

'Threat actors can use JPEG files to hide malware, or other malicious code from inspection. This query looks for the downloading of abnormally large JPEG files from a source where large JPEG files hav

Looks for advapi API functions

'This query look for users starting an Azure CloudShell session and summarizes the Azure Activity from that user account during that timeframe (by default 1 hour). This can be used to help identify ab

'This hunting query will identify where a file is uploaded to Azure File or Blob storage and is then accessed once before being deleted. This activity may be indicative of exfiltration activity.'

'This hunting query will try to identify instances where a file us uploaded to file storage and then deleted within a given threshold. By default the query will find instances where a file is uploaded

'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges. This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent provi

'Detect mass file deletion events within Azure File and Blob storage. deleteWindow controls the period of time the deletions must occur in, whilst the deleteThreshold controls how many files must be d

Looks for big numbers 20:sized

Detects 32-bit numeric values that may indicate obfuscation

Looks for big numbers 48:sized

Looks for big numbers 64:sized

Looks for big numbers 128:sized

Looks for big numbers 256:sized

Look for Blowfish constants

'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'

'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on Corrlea

Look for CRC16 table

Look for CRC32 [poly]

Look for CRC32 table

CRC32 table lookup

Look for CRC32b [poly]

Look for CRC32c (Castagnoli) [poly]

Looks for crypt32 CryptBinaryToStringA function

"This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by: - Aggregating requests into time-bound sessions with row_window_session(). - Defining a "us

Look for ElfHash

Look for FlyUtils.CnDES Decrypt ECB function

Look for FlyUtils.CnDES Encrypt ECB function

'This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization.'

'This query will look for events where guest user was invited but has not accepted/redeemed invite for unusually longer period. Any invites not redeemed for longer period of time can be misused and

'Detects observed Visual Studio Code (VS Code) extension installation activity on a user's system within the query time range. Note: This query does not return a complete per-user inventory of instal

"This query searches for any action type with high frequency that involves adding, modifying, or removing something in cloud app policies. It sees where the properties are modified such that the old v

'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965). The Spring Framework is one of the most widely used lightweight op

List of primes [char]

List of primes [long]

'Compares the current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by Azure Apps and automated approv

'Compares current day to last 14 days of audits to identify new audit activities. Useful for tracking malicious activity related to user/group additions/removals by specific users.'

'Finds instances where a file uploaded to blob or file storage and it is seen on an endpoint by Microsoft Defender XDR.'

Hunt package for 5 IOCs associated with Kimwolf

Hunt package for 112 IOCs associated with ClearFake

Hunt package for 2 IOCs associated with KongTuke

Hunt package for 3 IOCs associated with OtterCookie

Hunt package for 44 IOCs associated with Unknown malware

Hunt package for 3 IOCs associated with Cobalt Strike

Hunt package for 2 IOCs associated with Nanocore RAT

Hunt package for 2 IOCs associated with Remcos

SmartLoader is a multi-stage loader malware that establishes persistence and exfiltrates data by dropping additional payloads and maintaining command-and-control communication

StrelaStealer is a credential-stealing malware that exfiltrates

Vidar is a data exfiltration malware that steals credentials and sensitive information, often using encrypted channels to transmit stolen data to command-and-control servers.

Hunt package for 37 malicious URLs tagged as 32-bit

Hunt package for 24 malicious URLs tagged as ClearFake

Hunt package for 24 malicious URLs tagged as malware_download

Hunt package for 14 malicious URLs tagged as Mozi

'This hunting query will try to identify the user account used to perform a file upload to blob storage. This query can be used to match all file upload events, or filtering can be applied on filename

'Identifies when a new user is granted access and any subsequent audit related activity. This can help you identify rogue or malicious user behavior.'

'Detects when a user has successfully authenticated to another Microsoft Entra ID tenant with an identity in your organization's tenant. Ref: https://docs.microsoft.com/azure/active-directory/fundam

'Identifies accounts that have been added to a PIM managed privileged group'

'Identifies modifications to user's MFA settings. An attacker could use access to modify MFA settings to bypass MFA requirements or maintain persistence.

This query shows details about all approved Entra ID Governance Access Packages assignments. The results include the time the request was created and approved along with the justification text provide

'Looks for users retrieving BitLocker keys. Enriches these logs with a summary of alerts associated with the user accessing the keys. Use this query to start looking for anomalous patterns of key retr

'This detection looks the prevention of crash dumps being created. This can be used to limit reporting by malware, look for suspicious processes setting this registry key.'

Steal IE 7 credential

'breakdown of scripts running in the environment'

'Entropy calculation used to help identify Hosts where they have a high variety of processes(a high entropy process list on a given Host over time). This helps us identify rare processes on a given Ho

'Finds attempts to list users or groups using the built-in Windows 'net' tool '

'This hunting query looks for hosts exporting a mailbox from an on-prem Exchange server, followed by that same host removing the export within a short time window. This pattern has been observed by at

'Invoke-PowerShellTcpOneLine is a PowerShell script to create a simple and small reverse shell. It can be abused by attackers to exfiltrate data. This query looks for command line activity similar to

YARA rule: ldpreload

APC queue tasks migration

This rule checks MySQL database presence

'Looks for Base64-encoded commands associated with the Nishang reverse TCP shell. Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'

'This hunting query identifies updates to the RequiredResourceAccess property of an OAuth application. This property specifies resources that an application requires access to and the set of OAuth per

'Powercat is a PowerShell implementation of netcat. Whilst it can be used as a legitimate administrative tool it can be abused by attackers to exfiltrate data. This query looks for command line activi

'Finds PowerShell execution events that could involve a download'

The 'rat_rdp

The 'rat_telnet' YARA rule detects the presence of a Remote Administration

Remote Administration toolkit VNC

Remote Administration toolkit using webcam

'This detection uses Normalized Process Events to hunt Signed Binary Proxy Execution: Rundll32 activities'

Sniff Lan network traffic

'Beyond your internal software management systems, it is possible you may not have visibility into your entire footprint of SolarWinds installations. This is intended to help use process exection inf

Malware can spread east-west file

Malware can spread east-west using share drive

Match Windows Http API call

Match Windows Inet API call

Match Windows Inet API library declaration

Match Winsock 2 API library declaration

'Summarizes uses of uncommon & undocumented commandline switches to create persistence User accounts may be created to achieve persistence on a machine. Read more here: https://attack.mitre.org/wiki/T

Attackers can use Adfind which is administrative tool to gather information about Domain controllers, ADFS Servers. They may also rename executables with other benign tools on the system. Below query

Hunt package for 113 IOCs associated with ClearFake

Hunt package for 4 IOCs associated with KongTuke

Hunt package for 43 IOCs associated with Unknown malware

Cobalt Strike is a sophisticated malware used for command and control (C2) operations, enabling attackers

The Lumma Stealer malware is a data-exfiltration tool that steals sensitive information such as credentials, browser data, and cryptocurrency wallet details. It typically arrives via phishing emails containing malicious URLs or compromised websites that deliver the payload. SOC analysts should monitor for unusual outbound traffic, unexpected process executions, and signs of credential theft or

Hunt package for 2 IOCs associated with MaskGramStealer

StrelaStealer is a credential-stealing malware that exfiltrates sensitive data such as usernames, passwords, and browser cookies by establishing command-and-control (C2) communication through malicious domains. It

Vidar malware is a data exfiltration tool that steals credentials and sensitive information via encrypted channels, often leveraging stolen credentials or phishing to maintain persistence. It typically arrives through malicious email attachments, compromised credentials, or exploit kits, using IP:port and URL IOCs to establish command-and

'Shows the rarest processes seen running for the first time. (Performs best over longer time ranges - eg 3+ days rather than 24 hours!) These new processes could be benign new programs installed on ho

Hunt package for 3 malicious URLs tagged as 118-107-44-190-8080

Hunt package for 3 malicious URLs tagged as 118-107-44-213-8080

Hunt package for 3 malicious URLs tagged as 118-107-44-253-8080

Hunt package for 15 malicious URLs tagged as 144-91-86-92

Hunt package for 6 malicious URLs tagged as 32-bit

Hunt package for 5 malicious URLs tagged as 38-76-199-154-8888

Hunt package for 2 malicious URLs tagged as ascii

Hunt package for 7 malicious URLs tagged as ClearFake

Hunt package for 29 malicious URLs tagged as malware_download

Hunt package for 11 malicious URLs tagged as mirai

Hunt package for 13 malicious URLs tagged as Mozi

Affect private profile

Create or check mutex

Affect private profile

Affect system registries

Affect system token

'This detection uses Normalized Process Events to detect System Shutdown/Reboot (MITRE Technique: T1529)'

This query identifies Copilot Studio AI agents that have Model Context Protocol (MCP) tools configured. MCP tools extend agent capabilities but introduce additional security considerations because the

This query identifies AI agents whose owners are either disabled or removed from the organization. Orphaned agents without an active owner pose governance and security risks because no one is account

This query identifies AI agents that remain unpublished and have not been modified for at least 30 days. While these agents may not pose an immediate security threat, they can create operational inef

Perform crypto currency mining

Inject certificate in store

'This detection uses Normalized Process Events to hunt Certutil activities'

This query identifies Copilot Studio AI agents that are published and contain actions configured with Author Authentication (maker`s personal credentials) but have not been used or invoked in the last

This query identifies Copilot Studio AI agents that contain hard-coded credentials in Topics or Actions. Storing credentials in clear text within agent logic creates a security risk because these sec

This query identifies Copilot Studio AI agents that use HTTP actions to endpoints where Power Platform connectors are available (e.g., graph.microsoft.com, management.azure.com). Using direct HTTP ca

This query identifies Copilot Studio AI agents that send HTTP requests to endpoints using non-HTTPS schemes. Communication over unencrypted HTTP exposes sensitive data in transit and increases the ri

This query identifies Copilot Studio AI agents that send HTTP requests to endpoints using non-standard ports (other than 443). Communication over uncommon ports can indicate suspicious activity, unau

Identifies Copilot Studio AI agents with Model Context Protocol (MCP) tools configured using maker credentials. This configuration can create security risks because the tool runs with the maker`s pers

This query identifies Copilot Studio AI agents without authentication mechanisms. Authentication is an agent-level configuration. Such misconfiguration poses significant security risks because when t

This query identifies Copilot Studio AI agents that are shared broadly-either with the entire organization or configured for multi-tenant access. Such configurations significantly increase the risk of

This query identifies Copilot Studio AI agents that are published and use the maker`s personal credentials in their authentication or integration flows. This configuration introduces security risks b

This query identifies Copilot Studio AI agents that are published but have not been used by any user in the organization for the last 30 days. Dormant agents can create unnecessary exposure and may s

Advers

This query identifies Copilot Studio AI agents configured to send emails to external mailboxes (outside the organization`s domains). Such configurations can lead to sensitive or internal data being e

This query identifies Copilot Studio AI agents with classic orchestration that include Actions not referenced in any Topic. While unused Actions may not pose an immediate security risk, they can intr

Steal Firefox credential

Steal credential

Steal VNC credential

' This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation ac

'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware de

Dynamic DNS

Escalade priviledges

'The Exchange Powershell Snapin was loaded on a host, this allows for a Exchange server management via PowerShell. Whilst this is a legitimate administrative tool it is abused by attackers to performs

Run a keylogger

Lookup Geolocation

Lookup external IP

Communication using dga

Communications use DNS

File downloader/dropper

Communications over FTP

Communications over HTTP

Communications over IRC network

Communications over SSL

Communications over RAW socket

Take screenshot

Record Audio

Hunt package for 6 IOCs associated with Kimwolf

Hunt package for 107 IOCs associated with ClearFake

Hunt package for 6 IOCs associated with Unknown malware

Hunt package for 4 IOCs associated with Unknown Stealer

Hunt package for 2 IOCs associated with Remcos

Hunt package for 66 IOCs associated with StrelaStealer

Hunt package for 6 IOCs associated with Vidar

Hunt package for 21 malicious URLs tagged as 32-bit

Hunt package for 30 malicious URLs tagged as ClearFake

Hunt package for 18 malicious URLs tagged as elf

Hunt package for 10 malicious URLs tagged as exe

Hunt package for 12 malicious URLs tagged as malware_download

The Mozi malware family is a backdoor that enables remote command execution and data exfiltration, often used for persistent access and espionage. It typically arrives via phishing emails containing malicious URLs or through compromised websites hosting malicious domains. SOC analysts should monitor for unusual outbound traffic to listed domains, signs of lateral movement,

This query identifies A365 AI agents that contain hard-coded credentials in their tools or actions. Storing credentials in clear text within agent logic creates a security risk because these secrets

This query identifies A365 AI agents that send HTTP requests to endpoints using non-HTTPS schemes. Communication over unencrypted HTTP exposes sensitive data in transit and increases the risk of inte

This query identifies A365 AI agents that send HTTP requests to endpoints using non-standard ports (other than 443). Communication over uncommon ports can indicate suspicious activity, unauthorized n

This query identifies A365 AI agents that have Model Context Protocol (MCP) tools configured. MCP tools extend agent capabilities but introduce additional security considerations because they can exec

This query identifies A365 AI agents that have tools configured but they are not mentioned in instructions. This query identifies A365 AI agents that have tools configured but are not mentioned in in

This query identifies A365 AI agents whose owners are either disabled or removed from the organization, and are not blocked. Orphaned agents without an active owner pose governance and security risks

This query identifies A365 AI agents that are shared publicly. Such configurations significantly increase the risk of unauthorized access by unintended users, which could lead to data exposure or misu

This query identifies A365 AI agents that are published but have short or insufficient instructions. Short instructions increase the risk of prompt injection attacks, where malicious input can influe

This query identifies A365 AI agents that are published but lack configured instructions. Missing instructions increase the risk of prompt injection attacks, where malicious input can influence the a

Check if hotfix are applied

This query identifies Copilot Studio AI agents using generative orchestration to send emails via the Outlook connector where all action input values are populated dynamically by the orchestrator. Th

Create a COM server

Create a new process

Create a windows service

Bypass DEP

Disable Task Manager

'This query looks for messages related to file downloads of suspicious file types on an Exchange Server. This could indicate attempted deployment of webshells. This query uses the Exchange HttpProxy

'This query looks for suspicious request patterns to Exchange servers that fit patterns recently blogged about by PeterJson. This exploitation chain utilises an SSRF vulnerability in Exchange which ev

'This alerts when the account setting is changed to allow either external domain access or anonymous access to meetings.'

'Identifies when 30 or more ports are used for a given client IP in 10 minutes occurring on the IIS server. This could be indicative of attempted port scanning or exploit attempt at internet facing we

'Identifies when 100 or more failed attempts by a given user in 10 minutes occur on the IIS Server. This could be indicative of attempted brute force based on known account information. This could als

Hijack network configuration

Code injection with CreateRemoteThread in a remote process

Communications dyndns network

Communications over P2P network

Communications smtp

Communications smtp

Communications smtp

Listen for incoming communication

Communications over TOR network

Communications over Toredo network

Communications over UDP network

Install itself for autorun at Windows startup

'This query looks for suspicious request patterns to Exchange servers that fit a pattern observed by Silk Typhoon actors. The same query can be run on HTTPProxy logs from on-premise hosted Exchange se

'This query looks for messages related to file downloads of suspicious file types. This query uses the Exchange HttpProxy AOBGeneratorLog, you will need to onboard this log as a custom log under the t

'Alerts in links that have been shared across multiple Zoom chat channels by the same user in a short space if time. Adjust the threshold figure to change the number of channels a message needs to be

Hunt package for 124 IOCs associated with ClearFake

Hunt package for 12 IOCs associated with Unknown malware

Hunt package for 25 IOCs associated with Unknown Loader

Hunt package for 9 IOCs associated with Unknown Stealer

Hunt package for 10 IOCs associated with Nanocore RAT

Hunt package for 2 IOCs associated with Remcos

Hunt package for 5 IOCs associated with ValleyRAT

Vidar is a credential-stealing malware that exfiltrates sensitive data via encrypted channels, often targeting financial institutions and using persistence mechanisms to maintain long-term access.

Hunt package for 44 malicious URLs tagged as 32-bit

Hunt package for 40 malicious URLs tagged as ClearFake

Hunt package for 9 malicious URLs tagged as malware_download

Hunt package for 2 malicious URLs tagged as mirai

Hunt package for 5 malicious URLs tagged as Mozi

'The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in. You can also whitelist known good time zones in the tz_whitelist value using the tz data

Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names.

Affect hook table

'This alerts when end to end encryption is disabled for Zoom meetings.'

'Identifies accounts that are added to a privileged group and then quickly removed, which could be a sign of compromise.'

'Identifies whenever a user account has the setting "Password Never Expires" in the user account properties selected. This is indicated in Security event 4738 in the EventData item labeled UserAccount

'Detects successful signins using single factor authentication where the device, location, and ASN are abnormal. Single factor authentications pose an opportunity to access compromised accounts, inve

'Identifies connection attempts (success or fail) from clients with very short or very long User Agent strings and with less than 100 connection attempts.'

Checks if being debugged

Checks for the presence of known debug tools

Anti-Sandbox checks for Anubis

Anti-Sandbox checks for CWSandbox

Anti-Sandbox checks for Joe Sandbox

Anti-Sandbox checks for Sandboxie

Anti-Sandbox checks for ThreatExpert

AntiVM checks for Bios version

AntiVM checks for VirtualBox

AntiVM checks for VMWare

Detects when there is a login attempt from a country that has not seen a successful login in the previous 14 days. Threat actors may attempt to authenticate with credentials from compromised accounts

'Detects when a privileged user account successfully authenticates from a location, device or ASN that another admin has not logged in from in the last 7 days. Privileged accounts are a key target f

YARA rule: Check_FindWindowA_iat

YARA rule: Check_OutputDebugStringA_iat

YARA rule: check_RaiseException_iat

YARA rule: Check_unhandledExceptionFiler_iat

Anti-debug process memory working set size check

Disable AntiVirus

Disable Firewall

Disable Registry editor