Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects modification of shell profile files (.zshrc, .bash_profile, .profile) by processes named 'applet' or 'qtop'. This is a fallback persistence mechanism used by the ChillyHell malware.
Detects files containing Command and Control (C2) domains and IP addresses associated with the 'Operation Rewrite' SEO poisoning campaign (CL-UNK-1037). These indicators are often found embedded in BadIIS malware variants or related configuration files.
Detects Windows executables that write files with suspicious extensions
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process
Detects the ASP.NET page handler (webshell) used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
This rule detects the creation of Windows Defender Application Control (WDAC) policy files (.cip or .p7b) within the `C:\Windows\System32\CodeIntegrity\` folder by a process running with 'High' integrity. Attackers can leverage this technique to deploy custom WDAC policies that block Endpoint Detection and Response (EDR) components, effectively bypassing security measures and enabling undetected malicious activity after a system reboot.
Detects Covenant Grunt Stager modules used by APT28 in the Phantom Net Voxel campaign based on known file hashes. This rule specifically looks for the MD5 hashes of these stager modules in file event logs.
Detects fake image files (BMP, GIF, JPEG, PNG, TIFF) used by the BeardShell backdoor for command and control communications. These files contain an encrypted payload and a size field that matches the file's total size, a technique used by APT28 in the Phantom Net Voxel campaign.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
Amcache.hve is a Windows registry file that logs details about executed programs, including file paths, hashes, timestamps, and metadata. It helps reconstruct what was run on a system—even if the original file is gone. On the other hand, Shimcache is a memory-resident registry artifact that records executables seen or run by the system. It stores file paths and last modified timestamps, making it useful for tracking historical program execution—even after deletion. Attackers aware of forensic techniques could try to delete or alter these files to remove the evidences of their attacks:
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
Deleting or wiping Amcache.hve Overwriting or tampering with the SYSTEM hive to destroy Shimcache Using tools like SDelete, cipher /w:, or direct registry access to tamper logs
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Detects the presence of specific compromised versions of popular NPM packages. These versions were tampered with to include a malicious crypto wallet drainer as part of a supply chain attack.
Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence
Checks for the presence of the Antivirus Terminator files' hashes in the machine.
i.e.: VMToolsEng.exe and ServiceMouse.sys
i.e.: VMToolsEng.exe and ServiceMouse.sys
Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.
Detects scenarios where an attacker loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.
Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
This rule detects indicators of compromise (IOCs) associated with the 'ManualFinder/PDF Editor' malware campaign. It identifies malicious activity across multiple data sources, including file hashes, process hashes, suspicious certificate signers, suspicious company names in version info, suspicious file descriptions, malicious command execution, and network connections to known command and control (C2) or malicious PDF-related domains. The rule leverages external data sources for IOCs such as file hashes, C2 domains, PDF-related domains, suspicious signers, and malicious commands. It also includes static IOCs like specific file descriptions and company names. The detection logic is designed to identify various stages of the malware's activity, from initial execution to network communication.
Detects scenarios where an attacker attempts to edit IIS configuration file in order to load a module.
Page 114 of 139