Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,670
9,758
6,693
4,421
3,749
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
The analytic detects potentially malicious command lines using a pretrained machine learning text classifier. It identifies unusual keyword combinations in command lines, such as "streamreader," "webclient," "mutex," "function," and "computehash," which are often associated with adversarial PowerShell code execution for C2 communication. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command lines longer than 200 characters. This activity is significant as it can indicate an attempt to execute malicious scripts, potentially leading to unauthorized code execution, data exfiltration, or further system compromise.
Detects highly relevant antivirus alerts indicating the presence of hack tools or other attack tools. This rule emphasizes that even if the antivirus blocks the malware, the event requires investigation to understand how the tool initially compromised the system.
This rule detects attempts to disable security tools on macOS systems. It specifically looks for the use of '/bin/launchctl' to 'unload' security-related plists (property list files) associated with common security software like Objective-See's LuLu and BlockBlock, Google Santa, Carbon Black, Little Snitch, Tenable Nessus, OpenDNS Umbrella, Crowdstrike Falcon, osquery, Filebeat, Auditbeat, Packetbeat, and td-agent. Additionally, it detects attempts to disable macOS Gatekeeper using '/usr/sbin/spctl' with the 'disable' argument.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
Linux Virus Vit
YARA
Yara rule that detects Vit virus.
Yara rule that detects RedAlert ransomware.
Yara rule that detects McBurglar ransomware.
Yara rule that detects Ransomexx ransomware.
Page 23 of 24