Will Any of This Fire?

Palo Alto Unit 42 Threat Research: Tracking TamperedChef Clusters via Certificate and Code Reuse

Your manager forwards a threat report and wants to find out whether any detections would catch this campaign. You've found some that you think might fire and you're curious if there are community rules that could help. This post walks through answering these questions with the site search and assumes you've read the report.

The short version of the report: financially motivated clusters distribute trojanized productivity apps (PDF editors, calendar tools, ZIP utilities) through malvertising. Every first-stage binary carries a valid OV/EV code-signing certificate bought through shell companies. The apps install as 7-Zip self-extracting archives, profile the host, persist via scheduled tasks or registry Run keys, sleep for weeks, then fetch second-stage payloads (stealers, adware, proxyware) from per-campaign domains.

The method

Decompose the report into discrete behaviors, then run each behavior up the ladder. Each step answers a different question.

Technique check: technique:T1053.005. What rules exist for Windows scheduled tasks?
Predicate-leaf check: technique:T1053.005 indicator:=. What indicators are checked?
Structural and telemetry pivots: uses:, excludes:, with:, correlation:, has:. Given how this campaign executes, and given the telemetry you collect, would the rules fire?

The technique tag flatters you

Step one:

technique:T1053.005 returns 110 rules with all query languages represented. Scheduled task persistence coverage looks good.

technique:T1053.005117 results, showing first 3 |

RULEchronicle/MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Creation of scheduled task using command line

RULEelastic/A scheduled task was created

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

RULEelastic/At.exe Command Lateral Movement

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.

See all 117 results in live search

Step two:

technique:T1053.005 indicator:*=* shows where those rules anchor. The top indicator is Image ends_with \schtasks.exe with 26 contributing Sigma rules, followed by OriginalFileName=schtasks.exe and process_name=schtasks.exe variants. There's about 100 indicator results and skimming quickly suggests many of these rules rely on schtasks.exe execution or the command-line, which would work on some clusters of the malware: the Trend Micro post referenced in the Unit 42 post does capture a literal cmd.exe /c schtasks /Create command.

technique:T1053.005 indicator:*=*200+ results, showing first 10 |

INDICATORImageends_with\schtasks.exe·25 rules (sigma)

sigma Defrag Deactivation sigma Potential BearLPE Exploitation sigma Kapeka Backdoor Persistence Activity sigma Scheduled Task Creation From Potential Suspicious Parent Location sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation

INDICATOROriginalFileNameeqschtasks.exe·18 rules (sigma, elastic, splunk)

sigma Potential BearLPE Exploitation sigma Kapeka Backdoor Persistence Activity sigma Renamed Schtasks Execution sigma Schtasks From Suspicious Folders sigma Uncommon One Time Only Scheduled Task At 00:00

INDICATORprocess_nameeqschtasks.exe·10 rules (elastic, splunk)

elastic Suspicious ScreenConnect Client Child Process elastic Local Scheduled Task Creation splunk Scheduled Task Deleted Or Created via CMD splunk Scheduled Task Initiation on Remote Endpoint splunk Schtasks scheduling job on remote system

INDICATORCommandLinecontains␣/create␣·9 rules (sigma)

sigma Renamed Schtasks Execution sigma Scheduled Task Creation Via Schtasks.EXE sigma Suspicious Scheduled Task Creation Involving Temp Folder sigma Scheduled Task Creation with Curl and PowerShell Execution Combo sigma Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE

INDICATOREventIDeq4698·7 rules (splunk)

splunk Impacket atexec.py Scheduled Task Creation (Windows Event Log)splunk Rare Schedule Task Created (Windows Event Log)splunk Rare Scheduled Task (Windows Event Log)splunk Randomly Generated Scheduled Task Name splunk Short Lived Scheduled Task

INDICATORevent.typeeqstart·6 rules (elastic)

elastic Suspicious ScreenConnect Client Child Process elastic Local Scheduled Task Creation elastic Suspicious Execution via Scheduled Task elastic Persistence via TelemetryController Scheduled Task Hijack elastic UAC Bypass via DiskCleanup Scheduled Task Hijack

INDICATORevent.categoryeqprocess·4 rules (elastic)

elastic Potential PowerShell HackTool Script by Function Names elastic Outbound Scheduled Task Activity via PowerShell elastic Scheduled Task Created by a Windows Script elastic Suspicious Image Load (taskschd.dll) from MS Office

INDICATORprocess_nameeqpowershell.exe·4 rules (elastic)

elastic Suspicious ScreenConnect Client Child Process elastic Outbound Scheduled Task Activity via PowerShell elastic Local Scheduled Task Creation elastic Scheduled Task Created by a Windows Script

INDICATORCommandLinecontainspowershell·4 rules (sigma)

sigma Suspicious Modification Of Scheduled Tasks sigma Scheduled Task Creation with Curl and PowerShell Execution Combo sigma Schtasks From Suspicious Folders sigma Uncommon One Time Only Scheduled Task At 00:00

INDICATORCommandLinecontainscreate·4 rules (sigma)

sigma Potential ACTINIUM Persistence Activity sigma Kapeka Backdoor Persistence Activity sigma Scheduled persistent task with SYSTEM privileges creation sigma Scheduled task creation with command line

See all 200+ results in live search

However, there are other ways to register a scheduled task that don't involve the schtasks.exe process or command-line execution. You could use the PowerShell function Register-ScheduledTask (yes, it's a function, not a cmdlet) which invokes CIM/WMI > COM > RPC > the Task Scheduler service. value:Register-ScheduledTask matches 2 rules that use the PowerShell function. Additionally, while this isn't cited in the Unit 42 post, there is a G DATA analysis of the AppSuite PDF Editor that indicates another approach where tasks are registered with the Task Scheduler COM API.

value:Register-ScheduledTask2 results |

RULEsigma/Powershell Create Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

scriptblocktext match Register-ScheduledTask

RULEsplunk/Windows PowerShell ScheduleTask

T1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShell

The following analytic detects potential malicious activities involving PowerShell's task scheduling cmdlets. It leverages PowerShell Script Block Logging (EventCode 4104) to identify unusual or suspicious use of cmdlets like 'New-ScheduledTask' and 'Set-ScheduledTask'. This activity is significant as attackers often use these cmdlets for persistence and remote execution of malicious code. If confirmed malicious, this could allow attackers to maintain access, deliver additional payloads, or exec...

scriptblocktext in "*Register-ScheduledTask*"

Step three:

uses:TaskContent (rules that inspect Event ID 4698: A scheduled task was created task XML) matches 10 rules. This event fires regardless of registration method.

uses:TaskContent10 results, showing first 3 |

RULEsigma/Diamond Sleet APT Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability

uses: taskcontent

RULEsigma/Kapeka Backdoor Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

uses: taskcontent

RULEsigma/Suspicious Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.

uses: taskcontent

See all 10 results in live search

The lesson is to decompose a technique by the predicates that rules match on.

Telemetry decides whether anything fires

At install time, TamperedChef collects system version, hostname, active browsers, and in some intrusions patch levels, user and domain details, geolocation, and screen size.

technique:T1082,T1016,T1033,T1518 (System Information Discovery, System Network Configuration Discovery, System Owner/User Discovery, Software Discovery) returns 155 rules across all query languages.

technique:T1082,T1016,T1033,T1518200+ results, showing first 3 |

RULEchronicle/Hacktool - WinPEAS Execution Patterns

T1082 System Information Discovery

This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS chec...

RULEchronicle/Local Accounts Discovery

T1033 System Owner/User Discovery

Local accounts, System Owner/User discovery using operating systems utilities

RULEchronicle/MITRE ATT&CK T1033 Recon Successful Logon Enumeration Powershell CISA Report

T1033 System Owner/User Discovery

Detects the use of powershell to enumerate successful logins on a specific host

See all 200+ results in live search

Further investigation of the indicators behind those rules show a reliance on spawned discovery processes: Image=\systeminfo.exe, process_name=tasklist.exe, CommandLine substrings, PowerShell cmdlets. value:systeminfo alone returns 41 rules plus 10 indicators.

value:systeminfo54 results, showing first 10 |

INDICATORImageends_with\systeminfo.exe·11 rules (sigma)

sigma Exploited CVE-2020-10189 Zoho ManageEngine sigma Windows Suspicious Child Process from Node.js - React2Shell sigma Suspicious Shells Spawn by Java Utility Keytool sigma Suspicious Child Process Of Manage Engine ServiceDesk sigma Suspicious Processes Spawned by Java.EXE

INDICATORprocess_nameeqsysteminfo.exe·7 rules (elastic)

elastic Enumeration Command Spawned via WMIPrvSE elastic Suspicious PDF Reader Child Process elastic Suspicious JetBrains TeamCity Child Process elastic Suspicious MS Office Child Process elastic Suspicious MS Outlook Child Process

INDICATORCommandLinecontainssysteminfo·6 rules (splunk, kusto, sigma)

kusto Detect Suspicious Commands Initiated by Webserver Processes sigma Potential Devil Bait Malware Reconnaissance sigma Potential Exploitation of GoAnywhere MFT Vulnerability sigma Windows Suspicious Child Process from Node.js - React2Shell sigma Potential Data Exfiltration Activity Via CommandLine Tools

INDICATORUrlOriginalcontainssysteminfo·4 rules (kusto)

splunk System Information Discovery - Windows (PowerShell)splunk System Information Discovery - Windows (Sysmon)splunk System Information Discovery - Windows (Windows Event Log)

INDICATORprocess_nameinsysteminfo.exe·3 rules (splunk)

splunk Windows Cmdline Tool Execution From Non-Shell Process splunk Windows MSIExec Spawn Discovery Command splunk Windows Suspicious Child Process Spawned From WebServer

INDICATORprocess_namematch(?i)systeminfo.exe·3 rules (splunk)

splunk IcedID Discovery Commands (EDR)splunk IcedID Discovery Commands (Sysmon)splunk IcedID Discovery Commands (Windows Event Log)

splunk Common Reconnaissance Commands (PowerShell)splunk Common Reconnaissance Commands (Sysmon)

INDICATORCommandLinematch

(?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_trusts|tasklist|quser|tasklist|netstat|netsh|driverquery|cmdkey|tracert|net1?(\.exe)?\s+(group|use)($|\s|\.exe)

·2 rules (splunk)

splunk Common Recon Commands in Short Burst (Sysmon)splunk Common Recon Commands in Short Burst (Windows Event Log)

splunk Common Recon Commands in Short Burst (Sysmon)splunk Common Recon Commands in Short Burst (Windows Event Log)

See all 54 results in live search

Whether any of it fires depends on how the malware performs discovery and this isn't covered in the Unit 42 post. However, the G DATA post shows in-process collection through the app's bundled native module (get_sid(), GetPsList()) that probably doesn't use LOLBINs like tasklist.exe. This is a telemetry boundary rather than a detection gap. The Trend Micro post covers a cluster that shells out to powershell.exe running Get-WmiObject Win32_Process to find browser processes and inspects the registry for security products' uninstall strings.

value:Get-WmiObject returns 20 rules and 3 indicators anchored on ScriptBlockText and CommandLine, while the registry recon isn't covered in any rules (value:UninstallString, value:KasperskyLabSetup, etc).

value:Get-WmiObject24 results, showing first 3 |

INDICATORScriptBlockTextcontainsget-wmiobject·7 rules (splunk, sigma)

sigma Powershell Detect Virtualization Environment sigma Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script splunk Get WMIObject Group Discovery with Script Block Logging splunk GetWmiObject Ds Computer with PowerShell Script Block splunk GetWmiObject Ds Group with PowerShell Script Block

INDICATORCommandLinecontainsget-wmiobject·6 rules (splunk, sigma)

sigma Deletion of Volume Shadow Copies via WMI with PowerShell splunk Get WMIObject Group Discovery splunk GetWmiObject Ds Computer with PowerShell splunk GetWmiObject Ds Group with PowerShell splunk GetWmiObject DS User with PowerShell

INDICATORScriptBlockTextcontainsget-wmiobject␣·2 rules (sigma)

sigma Suspicious Get Local Groups Information - PowerShell sigma WMIC Unquoted Services Path Lookup - PowerShell

See all 24 results in live search

value:UninstallStringNo results found |

Run this query in live search

Structural operators can help refine your query. technique:T1053.005 uses:CommandLine returns 55 of the 110 scheduled-task rules; technique:T1053.005 -uses:CommandLine returns the complementary 55. A shop without command-line auditing loses half that surface, and technique:T1053.005 uses:ParentImage shows only 9 rules survive without Sysmon parent attribution. The uses: / -uses: operators are a telemetry-dependency audit you can run per technique.

technique:T1053.005 uses:CommandLine57 results, showing first 5 |

RULEchronicle/MITRE ATT&CK T1053.005 Windows Creation Of Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Creation of scheduled task using command line

uses: parentcommandline

RULEelastic/Suspicious Execution via Scheduled Task

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.

uses: commandline

RULEkusto/Detect Rare scheduled task created

T1053.005 Scheduled Task/Job: Scheduled Task

Persistence via Scheduled Tasks is a well-known technique used by adversaries to make sure their malware programs keep running an the compromised device. With this detection rule, you can search for scheduled tasks being created by processes that did not performed this before. > [!WARNING] > This detection rule is the base for the detection. You will need to add environment specific finetuning in order to limit the BP detections on legitimate processes

uses: commandline

RULEkusto/Detect Unsigned executable launch from scheduled task

T1053.005 Scheduled Task/Job: Scheduled Task

Persistence via Scheduled Tasks is a well-known technique used by adversaries to make sure their malware programs keep running an the compromised device. With this detection rule, you can search for unknown executables being launched from scheduled tasks. > [!WARNING] > This detection rule is the base for the detection. You will need to add environment specific finetuning in order to limit the BP detections on legitimate processes

uses: parentcommandline

RULEkusto/Persistence Via Scheduled Tasks

T1053.005 Scheduled Task/Job: Scheduled Task

This query identifies binaries that run as a scheduled task, by looking at the parent process command line. Of the identified binaries running as scheduled tasks it finds suspicious binaries by looking at the file signature and global prevalence.

uses: parentcommandline

See all 57 results in live search

technique:T1053.005 -uses:CommandLine60 results, showing first 5 |

RULEelastic/A scheduled task was created

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

RULEelastic/At.exe Command Lateral Movement

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.

RULEelastic/Creation or Modification of a new GPO Scheduled Task or Service

T1053.005 Scheduled Task/Job: Scheduled Task

Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines.

RULEelastic/Local Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.

RULEelastic/Outbound Scheduled Task Activity via PowerShell

T1053.005 Scheduled Task/Job: Scheduled Task

Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks.

See all 60 results in live search

technique:T1053.005 uses:ParentImage9 results, showing first 5 |

RULEkusto/Powershell Empire Cmdlets Executed in Command Line

T1053.005 Scheduled Task/Job: Scheduled Task

This query identifies use of PowerShell Empire's cmdlets within the command line data of the PowerShell process, indicating potential use of the post-exploitation tool.

uses: parentimage

RULEsigma/ChromeLoader Malware Execution

T1053.005 Scheduled Task/Job: Scheduled Task

Detects execution of ChromeLoader malware via a registered scheduled task

uses: parentimage

RULEsigma/HackTool - Default PowerSploit/Empire Scheduled Task Creation

T1053.005 Scheduled Task/Job: Scheduled Task

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

uses: parentimage

RULEsigma/OilRig APT Activity

T1053.005 Scheduled Task/Job: Scheduled Task

Detects OilRig activity as reported by Nyotron in their March 2018 report

uses: parentimage

RULEsigma/Potential Persistence Via Powershell Search Order Hijacking - Task

T1053.005 Scheduled Task/Job: Scheduled Task

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

uses: parentimage

See all 9 results in live search

Run keys and browser hijack

There's mention of registry Run key persistence.

technique:T1547.001 (Boot or Logon Autostart Execution) has 84 results

technique:T1547.00187 results, showing first 10 |

RULEchronicle/CurrentControlSet Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/CurrentVersion Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/Direct Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe

RULEchronicle/Modify User Shell Folders Startup Value

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detect modification of the startup key to a path where a payload could be stored to be launched during startup

RULEchronicle/New RUN Key Pointing to Suspicious Folder

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects suspicious new RUN key element pointing to an executable in a suspicious folder

RULEchronicle/Potential Suspicious Activity Using SeCEdit

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

RULEchronicle/Session Manager Autorun Keys Modification

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects modification of autostart extensibility point (ASEP) in registry

RULEchronicle/Suspicious Powershell In Registry Run Keys

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Detects potential PowerShell commands or code within registry run keys

RULEelastic/Execution of Persistent Suspicious Program

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage.

RULEelastic/Lateral Movement via Startup Folder

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.

See all 87 results in live search

value:CurrentVersion\Run shows 24 rules and 11 indicators

value:CurrentVersion\Run35 results, showing first 10 |

INDICATORTargetObjectcontains\software\microsoft\windows\currentversion\run·4 rules (sigma)

sigma Kapeka Backdoor Autorun Persistence sigma Suspicious Run Key from Download sigma Suspicious PowerShell In Registry Run Keys sigma New RUN Key Pointing to Suspicious Folder

INDICATORCommandLinecontains\software\microsoft\windows\currentversion\run·3 rules (sigma)

sigma Kapeka Backdoor Persistence Activity sigma Suspicious Autorun Registry Modified via WMI sigma Direct Autorun Keys Modification

INDICATORCommandLinecontains\software\wow6432node\microsoft\windows\currentversion\run·3 rules (sigma)

sigma Suspicious Autorun Registry Modified via WMI sigma Potential Persistence Attempt Via Run Keys Using Reg.EXE sigma Direct Autorun Keys Modification

INDICATORTargetObjectcontains\software\wow6432node\microsoft\windows\currentversion\run·3 rules (sigma)

sigma Suspicious Run Key from Download sigma Suspicious PowerShell In Registry Run Keys sigma New RUN Key Pointing to Suspicious Folder

INDICATORCommandLinecontainsmicrosoft\windows\currentversion\run·2 rules (sigma)

sigma Potential Ryuk Ransomware Activity sigma Suspicious SYSTEM User Process Creation

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\run\*·2 rules (elastic)

elastic Startup or Run Key Registry Modification elastic Persistence via WMI Standard Registry Provider

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\runonce\*·2 rules (elastic)

elastic Startup or Run Key Registry Modification elastic Persistence via WMI Standard Registry Provider

INDICATORTargetObjectwildcardhkey_users\*\software\microsoft\windows\currentversion\runonceex\*·2 rules (elastic)

elastic Startup or Run Key Registry Modification elastic Persistence via WMI Standard Registry Provider

INDICATORTargetObjectwildcardhklm\software\microsoft\windows\currentversion\run\*·2 rules (elastic)

elastic Startup or Run Key Registry Modification elastic Persistence via WMI Standard Registry Provider

INDICATORTargetObjectwildcardhklm\software\microsoft\windows\currentversion\runonce\*·2 rules (elastic)

elastic Startup or Run Key Registry Modification elastic Persistence via WMI Standard Registry Provider

See all 35 results in live search

I'm not sure if there are other community rules that would be useful for this threat report. G Data's analysis shows browser hijacking by sending Chromium's Preferences and Secure Preferences files over C2, obtaining modified versions and writing them back - value:*Secure*Preferences* doesn't have any results.

value:*Secure*Preferences*No results found |

Run this query in live search

Closing thoughts

The advanced search functionality is very useful to all sorts of teams: detection engineers, SOC analysts, incident responders, even red teams (for understanding the body of community rules and where coverage gaps may exist). If you found it helpful, I encourage you to contribute a novel detection to a public rule repo.

I built the event and rule catalogs because the existing sources of documentation were very fragmented and limited. There are maybe 300 events documented on Microsoft Learn in significant detail, with several hundred more documented on Ultimate Windows Security. There are as many as 965 events are recommended for collection by various sources and many of them are only documented in blog posts. I struggled to evaluate their importance for detections, and the large number of public rules and their distribution across different query languages made it harder. I hope this work helps make threat detection more tractable for practitioners.

The site is part of a larger personal effort to drive public information sharing and community collaboration. Aside from the catalogs and reference information, there are also free KQL labs with adversary emulation logs. There are two motivations behind building those labs: making this type of content available for free in a time when so much of it is gated behind paywalls, and coaxing folks into sharing interesting logs for community collaboration on detections.

Threat actors are armed with modern tools and moving faster than ever after gaining initial access. My ultimate goal is to convince folks to publish logs with their threat research posts like they do with file hashes. This will help defenders write, validate, and deploy detections in hours instead of days to weeks. I need your help to do this. If you agree its important, talk to decision makers in your org. This will engender goodwill among customers, prospective customers, and prospective talent.

My next major project will involve analysis of modern tools and publication of execution logs (and packet captures when relevant). It is inspired by the JPCERT/CC Tool Analysis Result Sheet and will include new telemetry sources.

Thanks for reading.

References

Palo Alto Unit 42 - Tracking TamperedChef Clusters via Certificate and Code Reuse
Trend Micro - EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks
G DATA - AppSuite PDF Editor Backdoor: A Detailed Technical Analysis
Jonathan Johnson - WMI Internals Part 2

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Will Any of This Fire?

The method

The technique tag flatters you

Telemetry decides whether anything fires

Run keys and browser hijack

Closing thoughts

References

Keyboard shortcuts

Search operators