Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
87
73
22
4
4
Contributors
39
25
23
23
13
Categories
67
53
47
22
21
Platforms
124
41
12
11
8
Products / Services
31
28
24
21
17
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
3
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
Detects the deletion of registry keys containing the MSTSC connection history
This rule detects the presence of the string "xhxhxhxhxhxpp" within the AdditionalFields of DeviceEvents. This string =represents a Mutex Indicator of Compromise (IOC).
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking. Unlike clearing logs with rm (which deletes the file), this technique involves editing to remove specific entries while leaving the file structure intact.
Common manipulation methods include: utmp-specific cleaners, and overwriting entries with null bytes,
Detects adversaries directly manipulating Linux login files to remove evidence of unauthorized access. These binary files record successful logins (wtmp), current sessions (utmp), and failed attempts (btmp).
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
This rule looks for the use of common interpeters in the context of editing binary login files.
Sophisticated attackers target these files because they're primary forensic artifacts for login tracking.
The rule detects when Windows Event Logs are cleared. Specifically, it looks for Event ID 1102, which indicates the Security log was cleared, or Event ID 104, which indicates the System log was cleared. This activity is often associated with anti-forensics techniques to hide malicious actions.
The rule detects the deletion of specific registry keys associated with UAC bypass techniques. Specifically, it looks for deletions where the 'TargetObject' field contains the string '\ms-settings\Shell\Open\command'. This activity is indicative of anti-forensics, as an attacker might delete these keys to remove evidence of privilege escalation after performing a UAC bypass.
Detects deletion of ms-settings registry keys used for UAC bypass techniques, indicating anti-forensics activity to remove evidence of privilege escalation.
This query retrieves the most recent record for each device and filters the results to show devices that are currently isolated.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
• The DeviceInfo table contains details about each device and its status over time.
• The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device.
• The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
This rule detects attempts to clear the connection history for Microsoft Terminal Server Client (MSTSC) by deleting specific registry keys or values. This activity can be performed by an attacker to remove forensic evidence of their remote access to a system.
This analytic detects the deletion of the USN Journal using the fsutil.exe utility. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because the USN Journal maintains a log of all changes made to files on the disk, and its deletion can be an indicator of an attempt to cover tracks or hinder forensic investigations. If confirmed malicious, this action could allow an attacker to obscure their activities, making it difficult to trace file modifications and potentially compromising incident response efforts.
The following analytic detects the execution of the 'rmdir' command with '/s' and '/q' options to delete files and directory trees. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it may indicate malware attempting to remove traces or components during cleanup operations. If confirmed malicious, this behavior could allow attackers to eliminate forensic evidence, hinder incident response efforts, and maintain persistence by removing indicators of compromise.
This rule detects attempts to unload filter drivers using the 'fltmc.exe' utility. Adversaries may unload filter drivers, which are often used by security products (like EDRs or antivirus), to impair defenses and evade detection. The rule specifically looks for 'fltmc.exe' being executed with the 'unload' command-line argument. It includes filters for known legitimate activities from Avira and ManageEngine to reduce false positives.
Detects the deletion of Internet Information Services (IIS) WebServer access logs, which could indicate an adversary attempting to remove forensic evidence of their activities on a compromised web server. The rule specifically looks for delete events targeting files within the common IIS log directory structure (`\inetpub\logs\LogFiles\`) with a `.log` extension.
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
An attacker has gained access to internal systems, and is now closing large amounts of tickets to cover their tracks. This could indicate account compromise, especially if paired with alerts for logins from new IP addresses or a successful login after a brute force attack. By identifying an influx of closed tickets
Detects scenarios where an attacker attempts enumerate the audit policy in place.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Page 6 of 10