Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
39
20
5
3
3
Contributors
18
14
10
5
4
Categories
29
16
14
13
11
Platforms
45
13
13
3
3
Products / Services
10
9
8
6
5
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
2
2
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
Detects blocked load attempts of revoked drivers
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Detects driver load of the Process Hacker tool
Detects driver load of the System Informer tool
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects potentially malicious or suspicious launchd entries that are not part of the default macOS system, often used for persistence. This rule is designed to be applied to Plaso output.
KQL Query from file: Detecting Windows Downdate Abuse
Detects the load of the vulnerable Lenovo driver as reported in CVE-2022-3699 which can be used to escalate privileges
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Detects the load of the signed poortry driver used by UNC3944 as reported by Mandiant and Sentinel One.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.
Detects blocked load attempts of revoked drivers
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Detects a service installed by a client which has PID 0 or whose parent has PID 0
Page 3 of 4