Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,439
11,829
5,873
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects the execution of 'tar.exe' with the '-x' command-line argument, indicating an attempt to extract compressed files. Adversaries often use legitimate utilities like 'tar.exe' to decompress data, which can help them avoid detection and prepare collected data for further actions like exfiltration. The rule specifically looks for the 'tar.exe' image or an original filename of 'bsdtar' combined with the extraction flag.
Detects the creation of a file with an uncommon extension in an Office application startup folder
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.
Detects the creation of hidden files or folders by appending the "::$index_allocation" stream to their names. This technique can be used by adversaries to prevent standard tools like Windows Explorer or PowerShell from accessing or listing these hidden artifacts, thereby evading detection and hindering forensic analysis.
Detects the creation of a file named "code_tunnel.json" when the creating process is not a legitimate Visual Studio Code executable. This indicates potential execution and usage of the VsCode tunneling utility by an unauthorized or renamed process, which could be used for command and control.
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Detects file being transferred via ScreenConnect RMM
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
This rule detects the creation or modification of specific file types (.wll, .xll, .xlam, .xla, .ppam) in Microsoft Office startup or add-in directories. These files can be used to establish persistence by executing malicious code when Microsoft Office applications (Word, Excel, PowerPoint) are launched. The rule specifically targets paths associated with Word Startup, Excel Startup, Excel XLSTART, and generic Microsoft Addins folders.
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.
ISO Image Mounted
Sigma
This rule detects when an ISO image is mounted on a Windows endpoint. It specifically looks for Event ID 4663 (An attempt was made to access an object) where the ObjectServer is 'Security', ObjectType is 'File', and the ObjectName starts with '\Device\CdRom'. The rule filters out common legitimate files found on mounted ISOs, such as 'autorun.ico', 'setup.exe', and 'setup64.exe', to reduce false positives. This activity can be indicative of an adversary using ISO images to bypass Mark-of-the-Web (MOTW) protections and deliver malicious payloads.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
Detects the creation of specific file artifacts associated with Adwind RAT (also known as jRAT). This includes 'javaw.exe' within the AppData\Roaming\Oracle\bin\java directory and '.vbs' files within a '\Retrive' directory, both known indicators of Adwind/jRAT activity.
This rule detects when common Windows shell and scripting applications (such as bash.exe, cmd.exe, cscript.exe, powershell.exe, certutil.exe, mshta.exe, wmic.exe, etc.) write files to suspicious system folders. The suspicious folders include 'C:\PerfLogs\', 'C:\Users\Public\', and 'C:\Windows\Temp\'. This activity can indicate an adversary attempting to stage or execute malicious payloads in less scrutinized directories for persistence or defense evasion.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Page 135 of 139