Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
239 detections
Filters
Last updated
All Time
Detection languages
92
71
26
15
15
Contributors
60
46
29
23
11
Categories
148
109
97
57
50
Platforms
204
19
14
8
1
Products / Services
68
38
34
12
10
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
2
1
1
1
1
IDS Classtypes
5
1
1
IDS Protocols
3
2
2
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Page 12 of 12