Browse Rules

AWS CloudTrail EC2 Enable Serial Console Access

Detects when the EC2 serial console access feature is enabled. This could abused by some attackers to avoid network detection when accessing to EC2 instances.

AWS CloudTrail EC2 Subnet Deleted

Detects when an attacker is destroying an EC2 subnet.

AWS CloudTrail IAM Password Policy Updated

Detects an update to the password policy. This could be an attempt to lower accounts security level.

AWS CloudTrail Route 53 Domain Transfer Lock Disabled

Detects when the transfer lock feature is disabled on a domain name handled by AWS Route 53 service.

AWS CloudTrail S3 Bucket Replication

Detects a replication rule being enable for a given S3 bucket: it could provide an attacker a way to exfiltrate data.

Data Compressed With Rar With Password

An adversary may compress data in order to make it portable and minimize the amount of data sent over the network, this could be done the popular rar command line program. This is a more specific one for rar where the arguments allow to encrypt both file data and headers with a given password.

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

Exchange PowerShell Snap-Ins To Export Exchange Mailbox Data

Detects PowerShell SnapIn command line, often used with Get-Mailbox to export Exchange mailbox data.

Hiding Files With Attrib.exe

Detects usage of attrib.exe to hide files from users.

HTA Infection Chains

Detect the creation of a ZIP file and an HTA file as it is often used in infection chains. Furthermore it also detects the use of suspicious processes launched by explorer.exe combined with the creation of an HTA file, since it is also often used in infection chains (LNK - HTA for instance).

HTML Smuggling Suspicious Usage

Based on several samples from different Botnets, this rule aims at detecting HTML infection chain by looking for HTML created files followed by suspicious files being executed.

Impacket Wmiexec Module

Detection of impacket's wmiexec example, used by attackers to execute commands remotely.

ISO LNK Infection Chain

Detection of an ISO download followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file.

ISO LNK Infection Chain

Detection of an ISO (or any other similar archive file) downloaded file, followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file. For events with `host.name`.

Microsoft Defender Antivirus Disable Services

The rule detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through command line and registry.

Microsoft Defender Antivirus Disabled Base64 Encoded

Detects attempts to deactivate/disable Microsoft Defender Antivirus (MDAV) through base64 encoded PowerShell command line.

Microsoft Defender Antivirus Set-MpPreference Base64 Encoded

Detects changes of preferences for Microsoft Defender Antivirus (MDAV) scan and updates. Configuring MDAV with base64-encoded commands is suspicious and could be related to malicious activities.

Microsoft Defender Antivirus Signatures Removed With MpCmdRun

Detects attempts to remove Microsoft Defender Antivirus (MDAV) Signatures using MpCmdRun legitimate MDAV executable. No signatures mean MDAV will be less effective (or completely useless depending on the option used).

Microsoft Defender Antivirus Threat Detected

Detection of a Microsoft Defender Antivirus (MDAV) alert indicating the presence of potential malware

Mshta Suspicious Child Process

Detects the use of various web request methods executed remotely via Windows PowerShell

Non-Legitimate Executable Using AcceptEula Parameter

Detects accepteula in command line with non-legitimate executable name. Some attackers are masquerading SysInternals tools with decoy names to prevent detection.

Powershell AMSI Bypass

This rule aims to detect attempts to bypass AMSI in PowerShell using specific techniques.

PowerShell AMSI Deactivation Bypass Using .NET Reflection

Detects Request to amsiInitFailed that can be used to disable AMSI (Antimalware Scan Interface) Scanning. More information about Antimalware Scan Interface https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal.

PowerShell invoking in the command line a registry value to execute.

Detects a d9114938 execution which grabs a value in the windows registry to execute it.

SOCKS Tunneling Tool

Detects the usage of a SOCKS tunneling tool, often used by threat actors. These tools often use the socks5 commandline argument, however socks4 can sometimes be used as well. Unfortunately, socks alone (without any number) triggered too many false positives.