Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,829 detections
Filters
Last updated
All Time
Detection languages
5,623
1,822
1,261
860
752
Contributors
3,246
2,040
1,233
910
828
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
9,730
2,538
1,168
276
100
Products / Services
3,075
2,976
2,352
1,065
955
MITRE Techniques
6,773
3,899
2,668
2,013
1,825
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects a two-stage behavior characteristic of the SonicCrypt crypter: 1) A process creates a suspicious executable in a Windows system directory. 2) The newly created executable is then launched by the Windows Task Scheduler.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
Checkpoint Researchers published an Article with a Behavior Analysis of the Pure Malware Family. This Query is based on the Analysis of the Researchers. thx to Checkpoint.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
RedCanary recommends to create a Policy wich opens js files in Notepad (https://redcanary.com/blog/threat-intelligence/notepad-javascript/) to prevent the execution of malicious payloads.
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
The analytic detects the execution of "mshta.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". This activity is significant because mshta.exe can be exploited to execute malicious scripts, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or establish persistence within the environment, posing a severe security risk.
The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment.
Detects potential command injection attempts in the body of HTTP POST requests. Attackers, such as those operating the RondoDoX botnet, exploit unsanitized input fields in web interfaces of SOHO routers, IoT devices, and other applications to execute arbitrary commands. This rule looks for common command-line tools and shell characters within the POST body, particularly in requests targeting parameters known to be vulnerable.
The analytic detects the creation, modification, or enabling of scheduled tasks that execute commands using native Windows shells (PowerShell, Cmd, Wscript, Cscript) or from public folders (Users, Temp, ProgramData). This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
This analytic detects the execution of hh.exe (HTML Help) spawning a child process. This indicates the use of a Compiled HTML Help (CHM) file to execute Windows script code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where hh.exe is the parent process. This activity is significant as it may indicate an attempt to execute malicious scripts via CHM files, a known technique for bypassing security controls. If confirmed malicious, this could lead to unauthorized code execution, potentially compromising the system.
This analytic detects the use of PowerShell commands to add or set exclusions in Windows Defender. It specifically looks for command-line executions containing "Add-MpPreference" or "Set-MpPreference" along with exclusion parameters such as "-Exclusion*", "-ControlledFolderAccessAllowedApplications*", or "-AttackSurfaceReductionOnlyExclusions*". Adversaries commonly use this technique to bypass Windows Defender's protections, allowing malicious code to execute undetected, maintain persistence, and perform further malicious activities without interference from the antivirus.
This analytic detects instances where web or application server processes (such as Java, Tomcat, Apache, Nginx, Node, Caddy, IIS, PHP) spawn a Linux or Windows shell. This activity is highly indicative of successful exploitation, potentially related to vulnerabilities like Log4Shell (CVE-2021-44228) or Spring4Shell (CVE-2022-22965), leading to unauthorized command execution, privilege escalation, or persistent access. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on parent-child process relationships and process names.
This rule detects the execution of 'netsh.exe' with command-line arguments indicating an attempt to discover firewall configurations. Specifically, it looks for 'netsh' combined with 'show firewall' and additional keywords like 'config', 'state', or 'rule', or 'name=all'. This activity is often performed by adversaries to understand the network environment and identify potential egress points or defensive measures.
The following analytic detects the use of PowerShell's download methods such as "DownloadString" and "DownloadData" from the WebClient class or Invoke-WebRequest and its aliases "IWR" or "Curl". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity can be significant as such methods and functions are commonly used in malicious PowerShell scripts to fetch and execute remote code. If confirmed malicious, this behavior could allow an attacker to download and run arbitrary code, potentially leading to unauthorized access, data exfiltration, or further compromise of the affected system.
The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
The following analytic detects the execution of AutoIt3, a scripting language often used for automating Windows GUI tasks and general scripting. It identifies instances where AutoIt3 or its variants are executed by searching for process names or original file names matching 'autoit3.exe'. This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware. If confirmed malicious, this activity could lead to unauthorized code execution, system compromise, or further propagation of malware within the environment.
This analytic identifies instances where `java.exe` or `tomcat.exe` spawns a Windows shell, such as `cmd.exe` or `powershell.exe`. This activity is significant as it may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell) or CVE-2022-47966. If confirmed malicious, attackers could execute arbitrary commands, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This rule detects common PowerShell download and execution cradles. It looks for command-line arguments that indicate an attempt to download content from the internet (e.g., '.DownloadString(', '.DownloadFile(', 'Invoke-WebRequest', 'iwr', 'Invoke-RestMethod', 'irm') combined with immediate execution (e.g., ';iex $', '| IEX', 'Invoke-Expression'). These patterns are frequently used by adversaries to fetch and execute malicious scripts or payloads directly in memory.
The analytic detects the use of Microsoft HTML Application Host (mshta.exe) to make remote HTTP or HTTPS connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments containing URLs. This activity is significant because adversaries often use mshta.exe to download and execute remote .hta files, bypassing security controls. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network infiltration.
This analytic detects the deletion of the USN Journal using the fsutil.exe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because the USN Journal maintains a log of all changes made to files on the disk, and its deletion can be an indicator of an attempt to cover tracks or hinder forensic investigations. If confirmed malicious, this action could allow an attacker to obscure their activities, making it difficult to trace file modifications and potentially compromising incident response efforts.
Page 474 of 564