Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
Yara rule that detects GTPDOOR backdoor.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths like PerfLogs, Users\Public, Windows\Temp, or Appdata\Local\Temp. This activity can be indicative of malware unpacking or staging.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
Detects specific command-line patterns and process image paths associated with the REvil ransomware group's attack on Kaseya VSA. The rule looks for execution of 'cert.exe' and 'MsMpEng.exe' from unusual paths, as well as specific file deletion commands and references to 'Kaseya VSA Agent Hot-fix' and 'agent.exe'/'agent.crt' in 'kworking' or 'kworking1' directories, which were observed during the Kaseya supply chain incident.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
This rule detects the execution of Gpg4win's GnuPG tool (gpg.exe or gpg2.exe) when it is used to encrypt files. The detection specifically looks for command-line arguments that indicate file encryption ('-c') and the use of a passphrase ('passphrase'). This activity can be indicative of malicious actors encrypting data for exfiltration or to render it inaccessible.
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location, specifically within the /tmp/ directory. Named pipes can be used for inter-process communication and their creation in temporary directories might indicate malicious activity such as local privilege escalation or data exfiltration.
This rule detects specific command-line parameters and image paths associated with Mustang Panda droppers. It looks for patterns like 'Temp\wtask.exe /create', specific environment variable manipulations ('%windir:~-3,1%%PUBLIC:~-9,1%', '%windir:~-1,1%'), VBScript execution with file paths containing 'C:\Users\' and '.txt', and the execution of 'Temp\winwsh.exe'. These indicators are characteristic of the dropper stage used by the Mustang Panda APT group.
Detects the execution of binaries located in potentially suspicious locations, specifically within the '/tmp/' directory, using the 'nohup' command. This behavior is often associated with malware attempting to maintain execution even after a user logs off or a session terminates.
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. This behavior is often associated with malware or adversaries attempting to execute payloads from temporary or user-writable directories.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.
Detects process activity patterns indicative of the Sliver C2 framework implants. Specifically, it looks for command-line arguments used by Sliver to execute PowerShell with specific encoding settings.
This rule detects suspicious child processes spawned by the VMware Tools daemon (vmtoolsd.exe). Adversaries may leverage vmtoolsd.exe to establish persistence by executing various scripting and command-line interpreters such as cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. The rule specifically filters out legitimate VMware Tools scripts related to power management to reduce false positives.
This rule detects specific command-line executions associated with Mustang Panda's activity, particularly targeting the Australian government, as reported by Lab52. The rule looks for two distinct patterns: the copying of 'SolidPDFCreator.dll' to a specific public user directory, and the modification of the Windows Registry 'Run' key to establish persistence for 'SolidPDF' using the same directory. These actions indicate an attempt to install and persist malicious software.
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Page 148 of 154