Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
Detects references to 'evisa_cookies.txt' in process command lines, which is indicative of data exfiltration related to the Omani eVisa portal, as observed in specific threat actor activities.
Identifies 'VirtualSmokestGuy120' in process command lines, which is an indicator of CastleRAT Build 120 persistence. This rule specifically looks for a unique string associated with this malware variant's persistence mechanism.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects wscript.exe spawning PowerShell with encoded command from C:\Temp.
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
Detects InvisibleFerret decoding XOR-encoded C2 IP strings.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
LdrCallEnclave shellcode execution
Cortex XDR
This rule detects the use of LdrCallEnclave, a function often associated with shellcode execution, when initiated by Python or an executable located in a user-writable temporary directory (e.g., Temp, AppData, ProgramData). The detection focuses on processes whose image name matches 'python', 'python3', or any executable name followed by '.exe', and whose path contains common temporary or user-writable directories. The rule specifically looks for 'ldrcallenclave' in the command line arguments, indicating potential malicious activity such as process injection or shellcode execution.
RawWNPF rootkit device artefact
Cortex XDR
This rule detects the presence of the RawWNPF rootkit by searching for references to '\device\rawwnpf' or 'rawwnpf' in process command lines. It focuses on process events and provides causality fields for investigation.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs. This rule searches across process and network events for these confirmation markers.
Detects the exploited Bomgar process explicitly attempting to read sensitive credential files (like the SAM registry hive dump or /etc/shadow) to escalate privileges.
Page 60 of 84