Unknown detection rules

Spot connections to rarely accessed external domains that are present in your watchlist, which could signify data exfiltration attempts or C2 communication.

Query to match common security log identifiers with IOCs held by the Cyware Intel watchlist that is created automatically by Cyware

Query identifies users denied registration for multiple webinars or recordings but successfully registered for at least one event. Threshold variable adjusts number of events user needs to be rejected from.

Identifies when rundll32 or cmd.exe is utilized to launch a malicious DLL or executable from explorer.exe. Indicative of a cmd window or LNK file executing a program or malware due to a user clicking on a file.

Identifies VBScript proxy execution through a registry key in \Microsoft\Windows\CurrentVersion.

Hunts for commonly utilized Microsoft programs (Word, Excel, Publisher, etc) and other programs known to malicious launch powershell or cmd, such as Internet Explorer, Chrome and Firefox.

Looks for valid variations of the -EncodedCommand parameter. Commonly used to encode or obfuscate commands, and not all occurrences are malicious.

Detects PowerShell commands downloading and execute code hosted on Pastebin and other services. This technique has been used by malicious actors to distribute malware, in particular it has been used by the EvilCorp Ransomware variants such as Sodinokibi.

Detect the aftermath of a successfully delivered and executed maldoc (Microsoft Office). Indicates an Office document was opened from an email or download/link, spawned a suspicious execution, and attempted to execute code via common Windows binaries.

Meant to detect process creations containing names consistent with the schema used by Metasploit or Impacket's PsExec tool. Metasploit and Impacket's PsExec tooling is used by malicious actors for lateral movement & performing actions on remote systems.

Identifies WerFault.exe creating a memory dump of lsass.exe (Local Security Authority Subsystem Service, a process responsible for the enforcement of security policies on Windows systems, which generates and stores credentials in its process memory).

Utilizes a list of commonly abused LOLB an attacker or malware would execute in quick succession. The presence of multiple executions of the programs within the list can be indicative of an infection or malicious activity occurring on a victim host.

Identify potential new registry key name that is a non-autorun and non-run key in the HKLM\Software\Microsoft\Windows\CurrentVersion\ registry key containing VBScript in the key value value.

View Cybersixgill Actionable alerts for last 30 days

This query identifies instances when public IP addresses are assigned to Azure Resources and show connections to those resources.

This query identifies instances where a user is added and subsequently removed from an Azure Key Vault access policy within a short duration, which could indicate attempts to credential access and persistence.

This query identifies when a new user is granted access and starts granting access to other users. This can help you identify rogue or malicious user behavior.

This query identifies sign-ins from non-compliant or MFA-less devices to privileged accounts using a pre-built watchlist. Microsoft Sentinel offers customizable watchlist templates for your environment.

This query tracks sign-ins via Nord VPN using a daily-updated API. Investigate unfamiliar sign-ins from VPNs unless common in your organization. It now includes UEBA logs IdentityInfo and BehaviorAnalytics for context.

This query finds successful logons from known VPS providers with suspicious token patterns. It's not exhaustive but covers prevalent providers. Now includes UEBA logs IdentityInfo and BehaviorAnalytics for context.

This query searches for failed sign-in attempts to disabled accounts summarized by the IP originating IP address.

This query searches for failed attempts to sign-in to disabled accounts summarized by account name. This query has also been updated to include UEBA logs IdentityInfo and BehaviorAnalytics for contextual information around the results.

This query finds AD applications with EWS permissions to read user mailboxes. Threat actors could misuse these for persistent mailbox access. Ensure these permissions are legitimately granted and necessary.

Query searches for operations with Write and Execute accesses.

Query searches for sources of network scans in Claroty telemetry to identify potentially hostile reconnaissance activity.

Query searches for conflicting assets.

Shows requests to URL where UrlCategory is not set.

Shows allowed requests to URI categories which heavily are used in Initial Access stage by threat actiors and may contain malicious content.

A normal user activity consists mostly of downloading data. Uploaded data is usually small unless there is a file/data upload to a website. Calculate the sum of BytesOut per Source-Destination pair over 12/24 hours.

Calculate the count of BytesIn per Source-Destination pair over 12/24 hours. Higher values may indicate beaconing. C2 servers reply with the same data, making BytesIn value the same.