Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,534 detections
Filters
Last updated
All Time
Detection languages
2,471
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,439
11,829
5,873
5,151
4,864
4,534
Platforms
3,833
1,048
471
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,598
1,416
1,297
744
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of a file named 'debug.bin' in the '\Temp\' directory, which is the default output filename used by the SafetyKatz tool for dumping LSASS memory. This activity is indicative of an attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects the creation of suspicious file types (e.g., executables, scripts, archives) within the `C:\PerfLogs\` directory. This directory is typically used for performance logs and primarily contains `.etl` files. The presence of other executable or script file types in this location is highly unusual and can indicate malicious activity, such as staging for execution, persistence, or data exfiltration.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
This rule detects the creation of the Process Monitor (procmon) driver file (.sys) by any process other than the legitimate Process Monitor executable itself (procmon.exe or procmon64.exe). This behavior can indicate an attempt to load a malicious or unauthorized driver, potentially for privilege escalation or persistence, by masquerading as a legitimate system utility.
Detects the creation or modification of 'WsmPty.xsl' or 'WsmTxt.xsl' files outside of the standard Windows system directories. This activity is indicative of an application whitelisting bypass technique involving 'winrm.vbs' and 'cscript.exe' to execute attacker-controlled XSL files.
Detects the creation of a specific '.url' file named 'file001.url' within the 'Recent' folder of Microsoft Office. This activity has been observed in potential exploitation attempts related to CVE-2023-36884, where adversaries drop such files to achieve persistence or execute malicious code.
This rule detects the creation of files with a '.dll' extension that have names matching known Windows system DLLs (e.g., 'secur32.dll', 'tdh.dll') but are created in unusual or non-standard system directories. The rule specifically excludes common legitimate system directories like 'System32' and 'SysWOW64' to reduce false positives. This behavior can indicate an attempt at DLL sideloading or other defense evasion techniques where an attacker places a malicious DLL with a legitimate system DLL name in a location that a legitimate application might load it from.
Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.
Detects the creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory. This file can be used as a persistence mechanism because its content is executed whenever certain tools under "C:\WINDOWS\System32\oobe\" (e.g., Setup.exe) fail to run.
Detects the creation of files with the '.pub' extension (Microsoft Publisher documents) in suspicious or uncommon locations such as temporary directories or public user folders. This activity could indicate an attacker abusing Publisher documents for malicious purposes, potentially as part of defense evasion or initial access.
This rule detects the creation of Microsoft Office files (Word documents, Excel spreadsheets) within the default startup folders for Microsoft Word and Excel. This technique can be used by adversaries to establish persistence, as these files will automatically execute or load when the respective Office application is launched. The rule specifically looks for file creations in paths containing '\Microsoft\Word\STARTUP' or '\Microsoft\Excel\XLSTART', and also considers paths containing both '\Office' and '\Program Files' along with '\STARTUP' or '\XLSTART'. It filters out legitimate creations by the Office applications themselves (WINWORD.exe, EXCEL.exe) to reduce false positives.
This rule detects the creation of a file named 'RemComSvc.exe', which is the default service executable name used by the RemCom utility. The presence of this file typically indicates the installation and execution of RemCom on a Windows system, often for remote administration or malicious purposes.
Detects the creation of a suspicious file by 'svchost.exe' in the 'Personalization\LockScreenImage' directory, specifically looking for files that are not in the 'C:\Windows\' directory and do not have common image extensions like '.jpg', '.jpeg', or '.png'. This behavior can indicate an adversary attempting to download or stage malicious files using the 'desktopimgdownldr' functionality, which is often associated with T1105 (Ingress Tool Transfer).
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects the creation of the LiveKD driver (LiveKdD.SYS) by any process other than the legitimate LiveKD executables (livekd.exe or livek64.exe). This could indicate an attempt to load a malicious or unauthorized driver using a renamed or masqueraded process.
Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Detects the creation of Usage Log files by the CLR (clr.dll) for specific system binaries. These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context. This activity can be indicative of defense evasion techniques where adversaries use trusted binaries to proxy execution of malicious code, and the CLR usage logs can reveal this activity.
Page 215 of 216