EXPLORE DETECTIONS
Detect .ace files associated with WinRAR absolute path transversal exploit, CVE-2018-20250
This query was originally published in the threat analytics report, *WinRAR CVE-2018-20250 exploit*
Detect .jse file creation events
This query was originally published in the threat analytics report, *Emulation-evading JavaScripts*.
Detect activity associated with malicious DLL, cyzfc.dat
These queries was originally published in the threat analytics report, *Attacks on gov't, think tanks, NGOs*.
Detect activity by the penetration tool, MailSniper
This query was originally published in the threat analytics report, *MailSniper Exchange attack tool*.
Detect anomalous process trees
This query generates process trees of given processes and performs anomaly detection on the process trees. It generates process trees up to 7th level.
Detect attempts to turn off System Restore
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
Detect BlueKeep exploitation attempts
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
Detect BlueKeep-related cryptocurrency mining
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
Detect cipher.exe deleting data
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
Detect clearing of system logs
This query was originally published in the threat analytics report, *Ransomware continues to hit healthcare, critical services*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/).
Detect Cobalt Strike invoked via WMI
This query was originally published in the threat analytics report, *Ryuk ransomware*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/).
Detect command-and-control communication related to BlueKeep cryptomining
This query was originally published in the threat analytics report, *Exploitation of CVE-2019-0708 (BlueKeep)*.
Detect credential theft via SAM database export by LaZagne
This query was originally published in the threat analytics report, *Ryuk ransomware*. There is also a related [blog](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/).
Detect CVE-2018-15982 exploit used to extract file from malicious RAR archive
This query was originally published in the threat analytics report, *CVE-2018-15982 exploit attacks*.
Detect CVE-2019-0863 (AngryPolarBearBug2) exploit
This query was originally published in the threat analytics report, **May 2019 0-day disclosures**.
Detect CVE-2019-0973 (InstallerBypass) exploit
This query was originally published in the threat analytics report, **May 2019 0-day disclosures**.
Detect CVE-2019-1053 (SandboxEscape) exploit
This query was originally published in the threat analytics report, **May 2019 0-day disclosures**.
Detect CVE-2019-1069 (BearLPE) exploit
This query was originally published in the threat analytics report, **May 2019 0-day disclosures**.
Detect CVE-2019-1129 (ByeBear) exploit
This query was originally published in the threat analytics report, **May 2019 0-day disclosures**.
Detect DoppelPaymer operators dumping credentials with ProcDump
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
Detect DoppelPaymer operators spreading files with PsExec
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
Detect DoppelPaymer operators stopping services
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
Detect DoppelPaymer performing reconnaissance with net.exe
This query was originally published in the threat analytics report, *Doppelpaymer: More human-operated ransomware*. There is also a related [blog](https://msrc-blog.microsoft.com/2019/11/20/customer-guidance-for-the-dopplepaymer-ransomware/).
Detect DoublePulsar execution
This query was originally published in the threat analytics report, *Motivated miners*.