Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of specific files within the SysAidServer Tomcat webapps directory, which are indicators associated with the Lace Tempest threat group (also known as FIN7). The rule looks for specific filenames and suffixes that have been observed in attacks involving PowerShell scripts by this group.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
This rule detects the creation of a file named "code_tunnel.json". This file is associated with the execution and usage of the Visual Studio Code (VSCode) tunneling utility. Adversaries can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control compromised systems.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.
Detects the creation of specific files in the ProgramData directory, which are known indicators of compromise associated with the Diamond Sleet APT group. These files include executables, DLLs, and other data files used in their attack campaigns.
Detects the creation of a specific file, 'inetmgr.exe', in the 'C:\Windows\ADFS\bg\' directory. This activity has been linked to the Onyx Sleet (also known as Andariel) APT group, particularly in the context of exploiting the TeamCity CVE-2023-42793 vulnerability.
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects the creation of an ISO file in the Outlook temporary folder or in the AppData temporary folder. This activity is typical of Qakbot TTPs observed from late July 2022, often associated with bypassing Mark-of-the-Web controls.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
Page 211 of 216