Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of new PowerShell module files (.ps or .dll) in the first folder of the module directory structure, specifically within '\WindowsPowerShell\Modules\*\'. This pattern is considered suspicious because legitimate PowerShell modules commonly include a version folder within their directory structure, making direct creation in the module root less common for benign modules.
This rule detects the creation of executable files (.exe) or dynamic link libraries (.dll) within the default Group Policy Object (GPO) storage folder. Adversaries may place malicious files in this location to leverage Group Policy for persistence, privilege escalation, or to distribute malware across a domain. The specific folder path targeted is '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\' which corresponds to the Default Domain Policy GPO.
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (Kernel Driver Utility) or Ghost-In-The-Logs, which uses KDU. This activity can indicate an attempt to load a malicious driver for defense evasion or other purposes.
This rule detects the creation of an executable file named "msiexec.exe" within the 'bin' directory of a ManageEngine SupportCenter Plus installation. This specific file creation pattern is associated with the exploitation of CVE-2021-44077, a vulnerability for which public Proof-of-Concept (POC) exploits are available. The presence of a newly created 'msiexec.exe' in this non-standard location within the application's directory indicates potential compromise and malicious activity, as legitimate 'msiexec.exe' is a system binary typically located in system directories.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.
Detects the creation of files with '.one' or '.onepkg' extensions in suspicious or uncommon locations, which could indicate the abuse of OneNote attachments for malware delivery. The rule specifically excludes files created by the legitimate OneNote application running from its standard installation path.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects the creation of Virtual Hard Disk (.vhd or .vhdx) files by common browser processes. This activity can be indicative of malware delivery, as adversaries may use VHD files to encapsulate payloads and bypass security controls, particularly Mark-of-the-Web (MOTW) protections.
Detects the creation of ".xml" and ".txt" files in folders within the "\AppData\Roaming\Microsoft" directory by specific uncommon processes. This behavior is associated with Devil Bait malware samples and stages as described by the NCSC.
Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents\" directory, which has been observed as an indicator for the COLDSTEEL RAT malware.
Detects the creation of shell scripts (files ending with .csh or .sh) within the '/etc/profile.d/' directory. This directory is used to store shell scripts that are executed when a user logs in, making it a common target for adversaries to establish persistence or elevate privileges.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
This rule detects the creation of '.cmdline' files, which are artifacts generated during dynamic C# compilation. Adversaries may use dynamic C# compilation to unpack and execute payloads without writing the compiled executable to disk, making it a defense evasion technique. The rule specifically looks for the creation of these files as an indicator of such activity, particularly when initiated by processes not typically associated with C# compilation.
This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.
Page 214 of 216