Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,439
11,829
5,873
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects AnyDesk writing binary files to disk other than "gcapi.dll".
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
Detects the presence and execution of Inveigh via dropped artefacts
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the creation of log files during a TeamViewer remote session
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Detects Octopus Scanner Malware.
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects the creation of the default output filename used by the wmiexec tool
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
Detects when an attacker creates a similar folder structure to Windows system folders (such as Windows, Program Files) but with an additional space in the directory name. This technique aims to trick the DLL load search order, leading to a "DLL Search Order Hijacking" attack where a malicious DLL can be loaded instead of a legitimate one.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Detects file creation events with filename patterns used by Impacket.
Detects file creation events with filename patterns used by CrackMapExec.
This analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. It leverages the Endpoint datamodel Filesystem node to identify suspicious file system events, specifically targeting paths and filenames associated with ScreenConnect. This activity is significant as it can lead to unauthorized access to sensitive files and directories, potentially resulting in data exfiltration or arbitrary code execution. If confirmed malicious, attackers could gain unauthorized access and control over the host system, posing a severe security risk.
This analytic detects suspicious discovery of virtual disk files and directories on Linux systems. It specifically looks for command-line executions using `find` or `grep` that target common virtual disk file extensions such as `.vhd`, `.vhdx`, and `.vmdk`. This activity may indicate an attacker's attempt to locate and access virtualized storage environments, which could contain sensitive data or critical system configurations. Unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise, enabling security teams to identify potential reconnaissance activities and respond promptly.
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
Page 134 of 139