Browse Rules

User-Execution

Browser Extensions - Chrome Extensions

Masquerading: Invalid Code Signature - Network Connections

Remote Services: Distributed Component Object Model

Component Object Model Hijacking - Vault7 trick

Trusted Developer Utilities Proxy Execution

Hijack Execution Flow: DLL Side-Loading

Inhibit system recovery

Attackers often delete backups prior to deploying ransomware in order to maximize their chances of getting the ransom paid. Since the organization doesn't have any backups anymore, it's significantly more likely that they will pay in order to retrieve their files. This is a classic definition of this technique "Inhibit system recovery".

Create or Modify System Process: Windows Service

Windows services can be used as a means of persistence in an environment, and can be created in multiple ways, one of which is remotely. Doing so often involves this service creation will be executed over RPC.

ADCS Certificate Requested via Web Interface

This query uses IIS logs to identify certificates requested via the web interface. In the first step, ADCS servers are listed by looking for an ADCS specific Uri Stem in the IIS logs events. A hard-coded ADCS server list can also be provided as environment variable instead (adcsserverlist). In a second step, requests to these servers done via the web interface are identified by looking for POST to a '/certsrv/certfnsh.asp' Uri.

ADWS Connection from Process Injection Target

The query first collects all network connections to the Active Directory Web Services (ADWS) service. It then searches for processes that inject into a process that makes a connection to ADWS. This can be used to detect process injection into a process that is used to query Active Directory.

ADWS Connection from Unexpected Binary

This query first collects the IP addresses of all machines that have the Active Directory Web Services (ADWS) service running. It then searches for network connections to these IP addresses from processes that are not expected to connect to ADWS.

ASR Bypass Executable Content

There is an ASR rule that detects whenever an Office application writes an executable file to disk. There is a documented bypass for this rule, which allows an attacker to write the file to disk with a benign extension (e.g., .txt or .tmp) and rename the file afterwards. This query tries to detect such behavior.

AWS Assume Role Added from Unknown External Account

This query searches for roles being created or updated where sts:AssumeRole is granted with an external AWS account. If the external AWS account id is not in a list of known accounts an alert is raised.

AWS Discovery Commands Executed from Instance Profile

This query searches for discovery commands (such as ListRoles and ListUsers) exceeding a predefined threshold, executed using credentials originating from an instance profile within 4 hours. This can indicate a compromised EC2 machine with an instance profile being used for reconnaissance of the AWS environment.

AWS Instance Profile Credentials Used from Unexpected IP

This query searches for API calls made by credentials originating from an instance profile. It creates a summary of the external IP addresses used for these calls. When the same instance is observed making calls from multiple IP addresses, this is considered suspicious and the rule triggers.

AWS Resource Shared with Unknown External Account

This query searches for resources being shared with an external AWS account that is not on a list of known trusted accounts.

AWS User Accessing Excessive Secrets

This query searches for an account which accesses a large number of secrets from various sources in AWS, including SSM secrets and instance passwords.

Azure AD Rare UserAgent App Sign-in

This query establishes a baseline of the type of UserAgent (i.e., browser, Office application, etc.) that is typically used for a particular application by looking back for a number of days. It then searches the current day for any deviations from this pattern, i.e., types of UserAgents not seen before in combination with this application.

Azure AD UserAgent OS Missmatch

This query extracts the operating system from the UserAgent header and compares this to the DeviceDetail information present in Azure Active Directory.

Beacon Traffic Based on Common User Agent Only Visiting Limited Number of Rare Domains

This query searches web proxy logs for a specific type of beaconing behavior by joining a number of sources together: - Traffic by actual web browsers - by looking at traffic generated by a UserAgent that looks like a browser and is used by multiple users to visit a large number of domains. - Users that make requests using one of these actual browsers, but only to a small set of domains - none of which are common domains. - The traffic is beacon-like, meaning that it occurs during many differe

Excessive enumeration of policy effective permissions

This query identifies for the enumeration of the effective permissions described on the Actions statement of the AWS Policy document. It is based on the evaluation performed by the SimulatePrincipalPolicy and SimulateCustomPolicy API calls.

Excessive Share Permissions

This query searches for event 5143, which is triggered when a share is created or changed and includes the share permissions. First it checks to see if this is an allow-listed share for the system (e.g., domain controller netlogon, print server print$, etc.) The share permissions are then checked against 'allow' rule (A) for a number of well-known overly permissive groups, like All Users, Guests, Authenticated Users, etc. If these are found, an alert is raised so the share creation may be audite

FireEye redteamtoolcountermeasures KQL queries

Ingress Tool Transfer - Certutil abuse

This query searches for invocations of certutil, including renamed versions with specific command-line parameters that indicate using certutil as a tool to download files.