Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,645 detections
Filters
Last updated
All Time
Detection languages
1,768
374
349
273
255
Contributors
908
676
593
359
164
Categories
1,500
1,168
781
528
521
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
807
512
432
340
300
MITRE Techniques
1,179
581
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
The following analytic detects CrowdStrike alerts for weak password policy violations, identifying instances where passwords do not meet the required security standards. These alerts highlight potential vulnerabilities that could be exploited by attackers, emphasizing the need for stronger password practices. Addressing these alerts promptly helps to enhance overall security and protect sensitive information from unauthorized access.
The analytic detects multiple CrowdStrike LOW severity alerts originating from the same endpoint, indicating a series of minor suspicious activities or policy violations. Specifically, it triggers when an endpoint generates three or more distinct types of LOW severity alerts. These alerts are not immediately critical but should be reviewed to prevent potential threats. They often highlight unusual behavior or low-level risks that, if left unchecked, could escalate into more significant security issues. Regular monitoring and analysis of these alerts are essential for maintaining robust security, as a cluster of different low-severity events can be an early indicator of a more significant compromise or an adversary's reconnaissance activities.
This analytic detects CrowdStrike alerts specifically categorized with a 'MEDIUM' severity. These alerts indicate suspicious activity that warrants prompt attention but is not immediately critical. Such activities might include unusual behavior or attempted policy violations. The rule processes CrowdStrike stream data, renames relevant fields for consistency, and then filters for events where the 'severity' field contains 'MEDIUM'. The primary goal is to identify and flag these medium-severity incidents for further investigation and mitigation to prevent potential escalation of attacks.
The following analytic detects CrowdStrike alerts for Medium Identity Risk Severity with a risk score of 55% or higher. These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity and protection of sensitive information and systems.
The analytic identifies the use of `sqlite3` querying the MacOS preferences to determine the original URL from which a package was downloaded. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions involving `LSQuarantine`. This activity is significant as it is commonly associated with MacOS adware and other malicious software. If confirmed malicious, this behavior could indicate an attempt to track or manipulate downloaded packages, potentially leading to further system compromise or persistent adware infections.
The analytic detects the presence of any version of the 3CXDesktopApp, also known as the 3CX Desktop App, on Mac or Windows systems. It leverages endpoint data to identify instances of the application running. This activity is significant because 3CX has identified vulnerabilities in versions 18.12.407 and 18.12.416, which could be exploited by attackers. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the affected systems.
The following analytic identifies the use of the native macOS utility, PlistBuddy, to create or modify property list (.plist) files. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions involving PlistBuddy. This activity is significant because PlistBuddy can be used to establish persistence by modifying LaunchAgents, as seen in the Silver Sparrow malware. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, and potentially escalate privileges on the compromised macOS system.
The following analytic detects the use of the PlistBuddy utility on macOS to create or modify property list (.plist) files. It leverages OSQuery to monitor process events, specifically looking for commands that interact with LaunchAgents and set properties like RunAtLoad. This activity is significant because PlistBuddy can be used to establish persistence mechanisms, as seen in malware like Silver Sparrow. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, and potentially escalate privileges on the compromised system.
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
Detects the execution of the `nscurl` utility on macOS with command-line arguments indicative of file download operations. This can be used by adversaries to transfer tools or other files into a compromised environment.
This rule detects the execution of the 'sysctl' command on macOS with specific arguments ('hw.', 'kern.', or 'machdep.'). Threat actors and malware commonly use 'sysctl' with these arguments to gather system hardware information, often as part of virtualization or sandbox evasion techniques. By querying system properties, adversaries can determine if they are operating in an analysis environment and adjust their behavior accordingly.
Detects when the Time Machine backup utility is disabled on macOS using the `tmutil` command-line tool. This action can be performed by an attacker to prevent system backups, hindering recovery efforts after an attack.
This rule detects attempts to delete macOS Time Machine backups using the native utility "tmutil" with the 'delete' command. Adversaries may perform this action to prevent victims from restoring their files, often as a precursor to a ransomware attack or other data destruction activities.
Detects the addition of a new file or path exclusion to macOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up, hindering recovery efforts.
Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
An attacker can use this to prevent backups from occurring.
An attacker can use this to prevent backups from occurring.
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil".
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
DNS query to a recently created domain
Page 169 of 174