Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
RedSun Detection
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack
Detects a CodePage modification using the "mode.com" utility to Russian language.
This behavior has been used by threat actors behind Dharma ransomware.
This behavior has been used by threat actors behind Dharma ransomware.
Detects suspicious process run from unusual locations
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline
Detects a potentially suspicious execution from an uncommon folder.
Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects a potentially suspicious execution of a process located in the '/tmp/' folder
Detects suspicious interactive bash as a parent to rather uncommon child processes
Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Detects a code page switch in command line or batch scripts to a rare language
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"
Detects suspicious ways to use the "DumpMinitool.exe" binary
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
Page 29 of 40