Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
This rule detects the creation of a property list (.plist) file within the `/Library/StartupItems/` or `/System/Library/StartupItems` directories on macOS. These directories are associated with a deprecated persistence mechanism where files placed within them are automatically executed at boot initialization. Adversaries can leverage this to establish persistence on a compromised system by ensuring their malicious code runs every time the system starts.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.
This rule detects the creation of new Microsoft Office macro-enabled files. These file types (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) can contain embedded macros, which are often used by adversaries for initial access, persistence, or execution of malicious code. Monitoring their creation can help identify suspicious activity related to macro-enabled document attacks.
Detects the creation of a file named "wpbbin.exe" in the "C:\Windows\System32\" directory. This activity can be indicative of a UEFI-based persistence method used by adversaries to maintain access to a system, often by injecting executable files into the boot process, potentially bypassing security measures like BitLocker.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Detects the creation of specific files associated with the Small Sieve malware. This includes files with a characteristic typo ('Microsift' instead of 'Microsoft') in their path or a specific filename ('MicrosoftWindowsOutlookDataPlus.txt') in the AppData\Local directory, which are indicators of the Small Sieve malware's activity.
Detects the creation of a specific file named 'Comadmin.dat' in the 'C:\Windows\System32\Com\' directory, which is identified as a kernel driver file indicator for the SNAKE malware. This rule aims to identify the presence of this known malicious file.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
Detects file creation patterns indicative of the CVE-2021-40444 exploit, specifically the creation of CAB and INF files by Microsoft Word in temporary internet cache or local temporary directories.
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
Page 212 of 216