Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. The rule specifically looks for conhost.exe being spawned by processes other than a predefined list of common and legitimate parents, while also filtering out specific command-line patterns for svchost.exe and Dropbox to reduce false positives.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
Detects suspicious file creations within the Palo Alto Networks PAN-OS' parent telemetry folder, specifically looking for filenames containing patterns indicative of OS command injection attempts related to CVE-2024-3400. These files are processed by the 'dt_curl' script, which can lead to arbitrary command execution if device telemetry is enabled and filenames are crafted to bypass shell-subprocess restrictions.
Yara rule that detects WolfsBane backdoor.
This rule detects suspicious user-agent strings associated with the GraphRunner tool. GraphRunner is a PowerShell script used for interacting with Microsoft Graph API and other Microsoft services, often for malicious purposes like token manipulation or brute-forcing client IDs. The rule specifically looks for a predefined set of user-agent strings that are hardcoded within GraphRunner's functions. Detection is focused on Azure Activity, Office 365, Azure AD, Azure AD Directory Audit, and Microsoft Graph Activity logs. The rule aggregates detections by principal IP or user ID over a 5-minute window.
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File System (CLFS) driver vulnerabilities. The rule identifies processes loading 'clfs.sys' from common temporary or user-writable directories often abused by malware or exploits.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
Detects the execution of a Word document via the WinWord Start Menu shortcut using `cmd.exe`. This behavior has been observed in KamiKakaBot samples to initiate the second stage of infection. The rule specifically looks for `cmd.exe` executing a command line that includes a `.lnk` file, a path containing `Start Menu\Programs\Word`, and a `.doc` file extension.
Detects the execution of `cmd.exe` with output redirection (`>`) to suspicious locations such as temporary directories, user profile directories, or `ProgramData`. This technique is often used by adversaries to save the output of reconnaissance commands (e.g., `hostname`, `dir`) to files for later exfiltration, helping them evade immediate detection by storing command output in less scrutinized locations.
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server. This vulnerability allows an attacker to create admin accounts and execute arbitrary commands. The rule specifically looks for suspicious child processes like bash, curl, or wget being spawned by the Confluence Java process.
Detects the execution of specific processes and command line combinations associated with the Forest Blizzard APT group. This includes the creation and deletion of scheduled tasks using 'schtasks.exe' and PowerShell commands for file operations, as described by Microsoft.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center / Confluence Server, where an attacker can exploit vulnerable endpoints to create admin accounts and execute arbitrary commands. Specifically, this rule looks for suspicious child processes like cmd.exe or powershell.exe being spawned by Tomcat processes associated with Confluence.
Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Page 146 of 154