Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects suspicious use of XORDump process memory dumping utility
Detects a CodePage modification using the "mode.com" utility.
This behavior has been used by threat actors behind Dharma ransomware.
This behavior has been used by threat actors behind Dharma ransomware.
Detects Windows executables that write files with suspicious extensions
Finds legitimate system32 or syswow64 executables being run under a different name and in a different location.
The rule will require tuning for your environment.
MITRE: Masquerading https://attack.mitre.org/techniques/T1036.
Get a list of all processes run, except those run from system32 or SysWOW64.
The rule will require tuning for your environment.
MITRE: Masquerading https://attack.mitre.org/techniques/T1036.
Get a list of all processes run, except those run from system32 or SysWOW64.
'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\.
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
Identify masqueraded DLLHost.exe file created by PowerShell.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, or a set of spaces or underlines to cloak the executable file, often used in spear phishing campaigns to trick users into executing malicious files.
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
The following analytic detects processes with names consisting of a single letter, which is often indicative of malware or an attacker attempting to evade detection. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because attackers use such techniques to obscure their presence and carry out malicious activities like data theft or ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized access, data exfiltration, or system compromise. Immediate investigation is required to determine the legitimacy of the process.
This analytic identifies `mmc.exe` spawning a Living Off The Land Binaries and Scripts (LOLBAS) execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `mmc.exe` is the parent process. This activity is significant because adversaries can abuse the DCOM protocol and MMC20 COM object to execute malicious code, using Windows native binaries documented by the LOLBAS project. If confirmed malicious, this behavior could indicate lateral movement, allowing attackers to execute code remotely, potentially leading to further compromise and persistence within the environment.
This analytic identifies a Living Off The Land Binaries and Scripts (LOLBAS) process being executed where its process name does not match its original file name attribute. Processes that have been renamed and executed may indicate an adversary attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. The detection logic specifically looks for process creation events where the `original_file_name` field (which stores the original name of the executable) does not match the `process_name` (the name of the process as it's currently running). It also filters out common system paths and uses a lookup table (`lolbas_file_path`) to identify known LOLBAS binaries.
This rule detects the execution of common debugger tools (x32dbg, x64dbg, windbg) on Windows endpoints. While these tools have legitimate uses for software development and analysis, they are frequently abused by malware, such as PlugX and DarkGate, for malicious purposes like DLL side-loading or code injection. Detecting their presence and execution, especially in environments where they are not typically used by non-technical users, can indicate suspicious activity and potential compromise. This rule is designed to help Security Operations Centers (SOCs) identify such potentially malicious tool usage.
The following analytic identifies instances where explorer.exe is spawned by unusual parent processes such as cmd.exe, powershell.exe, or regsvr32.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because explorer.exe is typically initiated by userinit.exe, and deviations from this norm can indicate code injection or process masquerading attempts by malware like Qakbot. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, evade detection, and maintain persistence within the environment.
The following analytic detects `wmiprvse.exe` spawning a LOLBAS execution process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where `wmiprvse.exe` is the parent process and the child process is a known LOLBAS binary. This activity is significant as it may indicate lateral movement or remote code execution by an adversary abusing Windows Management Instrumentation (WMI). If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe security risk.
This analytic identifies the execution of Living Off The Land Binaries and Scripts (LOLBAS) from unexpected file paths. LOLBAS are legitimate Windows binaries that can be abused by threat actors for malicious purposes, such as defense evasion or code execution. The rule specifically looks for processes that are identified as LOLBAS tools but are executed from a directory other than their standard or expected system locations (e.g., outside of Program Files, System32, or SysWOW64). This behavior can indicate an adversary attempting to bypass security controls or execute malicious code in a stealthy manner.
The following analytic detects an anomaly where an svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows service DLLs, and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity.
The following analytic identifies the execution of msdtc.exe with specific command-line parameters (-a or -b), which are indicative of the PlugX malware. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because PlugX uses these parameters to masquerade its malicious operations within legitimate processes, making it harder to detect. If confirmed malicious, this behavior could allow attackers to gain unauthorized access, exfiltrate data, and conduct espionage, severely compromising the affected system.
The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output (specifically LSASS memory dumps) get renamed, or a dump file is moved or copied to a different name. This behavior is often used by adversaries to evade detection when performing credential dumping.
Detects the execution of 'createdump.exe' or a renamed version of it, specifically when used to dump process memory. The rule looks for the original internal filename 'FX_VER_INTERNALNAME_STR' and command-line arguments indicative of memory dumping, such as '-u' or '--full' combined with '-f' or '--name' and a '.dmp' extension. This technique is often used by adversaries to extract credentials from processes like LSASS.
Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.
Page 38 of 40