Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
59
33
9
3
3
Contributors
27
20
16
7
7
Categories
78
42
20
9
9
Platforms
100
9
5
2
1
Products / Services
34
28
15
4
4
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
This analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, with data pulled from Splunk Observability Cloud. The detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
The analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUID, process name, parent process, and command-line executions. This activity is significant because it may indicate an attempt to execute unauthorized commands or scripts, often a precursor to further malicious actions. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment.
The analytic identifies shell activity within the Kubernetes privilege scope on a worker node, specifically when shell processes are consuming CPU resources. It leverages process metrics from an OTEL collector hostmetrics receiver, pulled from Splunk Observability Cloud via the Splunk Infrastructure Monitoring Add-on, focusing on process.cpu.utilization and process.memory.utilization. This activity is significant as unauthorized shell processes can indicate a security threat, potentially compromising the node and the entire Kubernetes cluster. If confirmed malicious, attackers could gain full control over the host's resources, leading to data theft, service disruption, privilege escalation, and further attacks within the cluster.
The following analytic detects the launch of rarely used applications within the environment, which may indicate the use of potentially malicious software or tools by attackers. It leverages Windows AppLocker event logs, aggregating application launch counts over time and flagging those that significantly deviate from the norm. This behavior is significant as it helps identify unusual application activity that could signal a security threat. If confirmed malicious, this activity could allow attackers to execute unauthorized code, potentially leading to further compromise of the system.
The following analytic detects an anomaly where an svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows service DLLs, and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity.
This analytic detects a suspicious process attempting to terminate the Lsass.exe process. It leverages Sysmon EventCode 10 logs to identify processes granted PROCESS_TERMINATE access to Lsass.exe. This activity is significant because Lsass.exe is a critical process responsible for enforcing security policies and handling user credentials. If confirmed malicious, this behavior could indicate an attempt to perform credential dumping, privilege escalation, or evasion of security policies, potentially leading to unauthorized access and persistence within the environment.
This rule detects suspicious parent processes for a set of well-known Windows system processes. It specifically looks for instances where `svchost.exe`, `taskhost.exe`, `lsm.exe`, `lsass.exe`, `services.exe`, `lsaiso.exe`, `csrss.exe`, `wininit.exe`, or `winlogon.exe` are spawned by a parent process that is not typically expected. The rule filters out legitimate parent processes such as those from security products (e.g., `SavService.exe`, `MsMpEng.exe`), common system directories (`System32`, `SysWOW64`), and cases where the parent process is null or empty.
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects whether a process is created from an image path that does not have a standard executable file extension (e.g., .exe, .com, .bin). This behavior can indicate advanced evasion techniques like process ghosting or other unorthodox methods to launch processes, where an executable might be disguised or loaded without a typical extension. The rule includes various filters to reduce false positives from legitimate system processes, temporary files, installer components, and specific third-party applications.
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
Detects process execution patterns associated with the Hermetic Wiper malware, specifically looking for a process named 'postgresql.exe' in a policydefinitions directory or specific command-line arguments used for credential dumping and logging.
Detects the creation of scheduled tasks using the 'crontab' utility on macOS, specifically when the command line indicates the crontab job is being uploaded from the '/tmp/' directory. This behavior can be indicative of an adversary establishing persistence or executing malicious code.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
This rule detects the execution of the 'tasklist' command, which adversaries may use to gather information about running processes on a system. This information can help them understand the system's environment and identify potential targets or further actions.
Detects the execution of Ruby with the '-e' flag, which allows for inline script execution, combined with specific keywords related to socket programming ('rsocket', 'TCPSocket') and common shell names ('ash', 'bash', 'bsh', 'csh', 'ksh', 'pdksh', 'sh', 'tcsh'). This combination is a strong indicator of an attempt to establish a Ruby-based reverse shell.
This rule detects the creation of potentially suspicious child processes by 'regsvr32.exe'. Regsvr32.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious code, often referred to as 'Squiblydoo'. The rule specifically looks for regsvr32.exe spawning common Windows utilities or scripting engines like calc.exe, powershell.exe, cmd.exe (implied by net.exe, net1.exe, reg.exe, schtasks.exe), mshta.exe, cscript.exe, and wscript.exe. This behavior is often indicative of defense evasion or execution techniques where regsvr32.exe is used to bypass application whitelisting or security controls.
Detects the creation of new processes using the 'wmic.exe' utility with the 'process call create' command-line arguments. This is a common technique used by adversaries for execution.
Detects the creation of a process executing as a user named "ANONYMOUS" where the parent process image path contains common system or user application directories. This behavior has been observed in the "MileStone2016" variant of the COLDSTEEL RAT.
Page 5 of 6