Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
The analytic detects Microsoft Office products writing `.cab` or `.inf` files, which is indicative of exploitation related to CVE-2021-40444. This activity may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector that can lead to remote code execution and system compromise.
The analytic detects the creation of image files (PNG, JPG, BMP, GIF, TIFF) in the AppData\Roaming folder by processes that also have a file reference in the same folder. This behavior is commonly associated with malware, such as the Remcos RAT, which captures screenshots and stores them in the AppData folder before exfiltrating them to a command-and-control server. If confirmed malicious, this activity could indicate unauthorized data capture and exfiltration, compromising sensitive information and user privacy.
The following analytic detects the creation of .iso.lnk files in the %USER%\AppData\Local\Temp\<random folder name>\ path, indicating that an ISO file has been mounted and accessed. This detection leverages the Endpoint.Filesystem data model, specifically monitoring file creation events in the Windows Recent folder. This activity is significant as it may indicate the delivery and execution of potentially malicious payloads via ISO files. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further system compromise.
This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.
The following analytic detects the creation of archived files in a temporary folder, which may contain collected data. This behavior is often associated with malicious activity, where attackers compress sensitive information before exfiltration. The detection focuses on monitoring specific directories, such as temp folders, for the presence of newly created archive files (e.g., .zip, .rar, .tar). By identifying this pattern, security teams can quickly respond to potential data collection and exfiltration attempts, minimizing the risk of data breaches and improving overall threat detection.
Detects the creation of batch (.bat) files within the Windows Startup folder, a common persistence mechanism. The rule prioritizes detection of files matching known malicious patterns, specifically 'HealthApp-*.bat' associated with the SORVEPOTEL malware, and flags other generic batch file creations in the Startup folder for investigation.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This analytic detects the creation of `sqlite32.dll` or `sqlite64.dll` files within the `%temp%` directory. This activity is often associated with the IcedID malware, which utilizes sqlite3 modules to parse browser databases and exfiltrate sensitive information like banking details, credit card information, and credentials. Detection of this behavior could indicate data theft and compromise of user accounts.
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. Adversaries may create this file to test AppLocker policies or to bypass them.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
This rule detects when specific Windows executables (csrss.exe, lsass.exe, RuntimeBroker.exe, sihost.exe, smss.exe, wininit.exe, winlogon.exe, dllhost.exe, rundll32.exe, svchost.exe) write files with suspicious extensions such as .bat, .dll, .exe, .hta, .iso, .ps1, .txt, .vbe, and .vbs. This behavior can indicate defense evasion or other malicious activity where legitimate system processes are abused to drop or create malicious files.
Detects the creation of files with names used by Yurei ransomware to masquerade as legitimate system processes or backups in unusual locations.
Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.
Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770, which could lead to webshell deployment.
Detects when a command-line interpreter (cmd.exe or powershell.exe) writes or modifies a file within a SharePoint \TEMPLATE\LAYOUTS directory. This activity is suspicious as it could indicate an attempt to deploy a web shell or other malicious code to gain persistent access or execute commands on the SharePoint server. The rule specifically excludes a known legitimate SharePoint automation script to reduce false positives.
Detects the creation of a file named 'spinstall0.aspx' within specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.
Detects the creation or modification of specific files identified as indicators of compromise (IOCs) used by UNC4841 in their exploitation of Barracuda ESG appliances. These files are associated with various stages of the attack, including persistence, execution, and defense evasion.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
Page 196 of 216