Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,445
11,833
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.
Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.
Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.
Detects PowerShell executable being copied to the ProgramData directory and renamed to 'wt.exe' (Windows Terminal) to masquerade as a legitimate binary. This is a documented defense evasion technique used by the Windows dropper for the Axios npm supply chain attack.
Identifies a process that has successfully modified the /etc/sudoers file. The sudoers file controls which users have administrative privileges and whether they require a password to execute commands as root. Unauthorized changes to this file are a primary method for attackers to gain permanent, passwordless "root" access to a system. This rule correlates the initiator process with the file modification event to identify the source of the change.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
Detects the creation of .pth files inside a Python site-packages or dist-packages directory. This technique was leveraged by TeamPCP in the LiteLLM supply chain attack to gain automatic execution every time the Python interpreter was started.
Detects network connections to a suspicious Vercel application URL ('vscode-ext-git.vercel.app') combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential ingress tool transfer or data exfiltration attempts.
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.
Detects network connections to a suspicious Vercel application URL combined with file events initiated by command-line shells (cmd.exe, powershell.exe, pwsh.exe) using 'curl' in their command line. This correlation suggests potential data exfiltration attempts as noted in the linked blog post.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
Detects known malicious file hashes associated with compromised axios npm package (RAT activity)
Detects the creation of files within a specifically misspelled 'Photoes' directory located in ProgramData. This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger to store XOR-encrypted keystroke logs (.trn files).
Detects .NET executables created in the Windows temp staging
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
directory C:\windows\temp\s\, a known Agrius wiper deployment location.
Detects creation of known malicious files linked to axios compromise
This rule detects various indicators of compromise associated with the GlassWorm malware. It monitors for network connections to known GlassWorm remote IPs and domains, process activity involving specific GlassWorm filenames, folder paths, command line arguments (including wallet addresses and command terms), and registry modifications for persistence (Run/RunOnce keys with GlassWorm-related values). The rule correlates multiple evidence types to reduce false positives.
Detects the creation of an executable named 'msbuild.exe' or its associated '.lock' file inside the Windows user Startup folder by Python or CI/CD processes. This technique was observed in the TeamPCP campaign compromising the Telnyx Python SDK, where a fake MSBuild binary was dropped for stealthy persistence and the lock file was hidden via 'attrib +h'.
This rule detects BITS job configuration files that exhibit characteristics of persistence mechanisms. It looks for the presence of BITS job structure elements, and sevral indicators suggesting abuse
Detects malicious/suspicious systemd generator files for persistence mechanisms
Detects malicious/suspicious systemd generator files for persistence mechanisms
This rule detects suspicious network connections to api.telegram.org from processes masquerading as legitimate Windows executables (MicDriver.exe, Winappx.exe, MsCache.exe, RuntimeSSH.exe, smqdservice.exe). It also identifies files with MD5 hashes matching known Indicators of Compromise (IOCs) from an external list. This combination suggests potential malware activity, possibly involving Telegram for command and control or data exfiltration, combined with process masquerading for evasion.
Page 103 of 139