Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
This rule detects when known WMI-related modules are loaded by processes that are not typically associated with WMI operations. It specifically looks for the loading of DLLs such as 'fastprox.dll', 'wbemcomn.dll', 'wbemprox.dll', 'wbemsvc.dll', 'WmiApRpl.dll', 'wmiclnt.dll', 'WMINet_Utils.dll', 'wmiprov.dll', and 'wmiutils.dll'. The rule then filters out common legitimate processes that are known to load these WMI modules, including executables located in standard Windows directories (Program Files, System32, SysWOW64), .NET Framework paths, explorer.exe, and specific applications like WindowsAzureGuestAgent, WaAppAgent, Thor, Microsoft Defender's MsMpEng.exe, Microsoft Teams, and Sysmon. The intent is to identify potentially malicious use of WMI by uncommon or unexpected processes, which could indicate execution, persistence, or privilege escalation attempts.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
This rule detects the use of the `netsh interface portproxy` command to enable port forwarding, specifically looking for `v4tov4` configurations. It also identifies the creation or modification of associated registry settings under `HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4`, which are indicative of port proxying being configured on a Windows system.
Detects AnyDesk writing binary files to disk other than "gcapi.dll".
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)
Detects potential RDP connection via Mstsc using a local ".rdp" file
Detects potentially suspicious child processes launched via the ScreenConnect client service.
This rule detects the execution of the Mimikatz tool by looking for the string "mimikatz" (case-insensitive) in the command line of newly launched processes. Mimikatz is a well-known credential dumping tool often used by adversaries to extract plaintext passwords, hash, PIN codes, and Kerberos tickets from memory.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). Adversaries often use these shares for lateral movement, file transfer, and remote execution within a network. The rule specifically looks for command-line executions containing 'net use' followed by one of the common administrative share names, case-insensitively.
Detects the creation of named pipes with specific names known to be used by the Turla APT group. These named pipes include '\atctl', '\comnap', '\iehelper', '\sdlrpc', and '\userpipe'. The rule relies on Sysmon Event ID 17 or 18 for named pipe creation events.
Detects the launch of specific utilities (like ntdsutil, vssadmin, diskshadow, esentutl) on key servers. These utilities can be used by adversaries to access or copy the Active Directory domain database (NTDS.dit) or inhibit system recovery, which are common techniques for credential dumping and persistence.
This rule detects the launch of processes whose associated file hash (SHA256) has a low prevalence across the monitored environment. Specifically, it flags processes where the SHA256 hash has been observed on 1 to 3 distinct endpoints over the past 10 days. This can indicate the execution of rare or newly introduced executables, which could be malicious.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). It specifically looks for these commands being executed by users who are not part of the 'Information Technology' department or who have the title 'Intern', indicating potentially suspicious activity or a deviation from standard administrative practices. The rule leverages user enrichment data to refine its detection.
This rule detects suspicious command-line activity indicative of credential access or reconnaissance, as outlined in a CISA 'Living off the Land' report. Specifically, it looks for commands that attempt to list SSH known hosts, access Firefox profiles, execute Mimikatz, query OpenSSH or RealVNC registry keys, or save SAM/SYSTEM registry hives. While individual commands might be benign, their combined presence or repeated execution could signal malicious intent.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
This rule detects the use of PowerShell to enumerate successful logon events (Event ID 4624) from the security event log on a Windows host. It specifically looks for command-line executions containing 'Get-EventLog', 'security', and '-instanceid 4624'. This activity is often performed during the reconnaissance phase by adversaries to understand user activity on a system.
This rule detects DNS queries to domains identified as Command and Control (C2) infrastructure within a Threat Intelligence (TI) feed, specifically MISP. It correlates DNS events with MISP data where the entity type is 'DOMAIN_NAME' and the threat summary indicates 'C2 domains'. The rule is designed to identify potential C2 communications from internal hosts.
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
Page 392 of 465