Claims per month, 2026-01 to 2026-10. Peak 44 in 2026-04.
162232443242929112
2026-012026-10
Show monthly counts as a table
Month
Claims
2026-01
16
2026-02
22
2026-03
32
2026-04
44
2026-05
32
2026-06
42
2026-07
9
2026-08
29
2026-09
11
2026-10
2
0 additional claims without a disclosure date
Defensive actions
The MITRE ATT&CK mitigations countering the most of this group's known techniques, derived automatically from MITRE's own group and mitigation data. Each links to the full guidance with NIST 800-53 controls and authoritative configuration sources.
SigmaHQ detection rules mapped to this group's MITRE ATT&CK techniques. One technique maps to many rules, so this shows the top few by status and severity, with a link to the full set on SigmaHQ.
Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community
Detection prerequisites: Platform: windows · Service: system
False positives: Not provided by SigmaHQ.
Show rule YAML
title: Zerologon Exploitation Using Well-known Tools
id: 18f37338-b9bd-4117-a039-280c81f7a596
status: stable
description: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
references:
- https://www.secura.com/blog/zero-logon
- https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
author: 'Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community'
date: 2020-10-13
modified: 2021-05-30
tags:
- attack.t1210
- attack.lateral-movement
logsource:
service: system
product: windows
detection:
selection:
EventID:
- 5805
- 5723
keywords:
- kali
- mimikatz
condition: selection and keywords
level: critical
Detection prerequisites: Platform: windows · Log source: process_creation
False positives: Admin activity; Scripts and administrative tools used in the monitored environment
Show rule YAML
title: Fsutil Suspicious Invocation
id: add64136-62e5-48ea-807e-88638d02df1e
status: stable
description: |
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
- https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
- https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
- https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
author: Ecco, E.M. Anhaus, oscd.community
date: 2019-09-26
modified: 2023-09-09
tags:
- attack.impact
- attack.stealth
- attack.t1070
- attack.t1485
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\fsutil.exe'
- OriginalFileName: 'fsutil.exe'
selection_cli:
CommandLine|contains:
- 'deletejournal' # usn deletejournal ==> generally ransomware or attacker
- 'createjournal' # usn createjournal ==> can modify config to set it to a tiny size
- 'setZeroData' # file setZeroData ==> empties a file with zeroes
condition: all of selection_*
falsepositives:
- Admin activity
- Scripts and administrative tools used in the monitored environment
level: high
False positives: Exploits that were attempted but unsuccessful.; Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.
Show rule YAML
title: OMIGOD HTTP No Authentication RCE - CVE-2021-38647
id: ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
status: stable
description: |
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.
Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).
Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
references:
- https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
- https://twitter.com/neu5ron/status/1438987292971053057?s=20
author: Nate Guagenti (neu5ron)
date: 2021-09-20
modified: 2025-11-03
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.execution
- attack.lateral-movement
- attack.t1068
- attack.t1190
- attack.t1203
- attack.t1021.006
- attack.t1210
- detection.emerging-threats
- cve.2021-38647
logsource:
product: zeek
service: http
definition: Enable the builtin Zeek script that logs all HTTP header names by adding "@load policy/protocols/http/header-names" to your local.zeek config file. The script can be seen here for reference https://github.com/zeek/zeek/blob/d957f883df242ef159cfd846884e673addeea7a5/scripts/policy/protocols/http/header-names.zeek
detection:
selection:
status_code: 200
uri: /wsman
method: POST
auth_header:
client_header_names|contains: 'AUTHORIZATION'
too_small_http_client_body:
request_body_len: 0
# winrm_ports:
# id.resp_p:
# - 5985
# - 5986
# - 1270
condition: selection and not auth_header and not too_small_http_client_body
# condition: selection and winrm_ports and not auth_header and not too_small_http_client_body # Enable this to only perform search on default WinRM ports, however those ports are sometimes changed and therefore this is disabled by default to give a broader coverage of this rule
falsepositives:
- Exploits that were attempted but unsuccessful.
- Scanning attempts with the abnormal use of the HTTP POST method with no indication of code execution within the HTTP Client (Request) body. An example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. See description for investigation tips.
level: high
Atomic Red Team validating tests mapped to this group's MITRE ATT&CK techniques, shown beside the detection rules so you can validate the detections. This shows the top few, with a link to the full set on GitHub. Descriptive metadata only, never the attack commands.
Find Drone CI configuration files (.drone.yml), which may contain credentials, secrets, or sensitive environment variables used in Drone CI/CD pipelines.
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
This atomic runs several API calls (sts:GetCallerIdentity, s3:ListBuckets, iam:GetAccountSummary, iam:ListRoles, iam:ListUsers, iam:GetAccountAuthorizationDetails, ec2:DescribeSnapshots, cloudtrail:DescribeTrails, guardduty:ListDetectors) from the context of an EC2 instance role. This simulates an attacker compromising an EC2 instance and running initial discovery commands on it. This atomic test leverages a tool called stratus-red-team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.discovery.ec2-enumerate-from-instance/