Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule identifies process and file creation events where the associated file's SHA256 hash is present in Google Safe Browsing data and has been observed for a duration greater than 7 days (604,800 seconds). This long observation period for a Safe Browsing-flagged hash could indicate persistent malware or a file that has been present on systems for an extended time before being flagged or detected.
This rule detects the execution of various Windows-based hacktools by matching their import hash (imphash). This method allows for detection even if the tool's filename has been changed. The rule includes imphashes for tools such as PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, PPLDump, NanoDump, HandleKatz, DripLoader, UACMe, WCE, Sliver Stagers, Dumpert, SysmonEnte, SysmonQuiet, ShaprEvtMute Hook, Forkatz, PPLKiller, Backstab, Forensia, EDRSandBlast, and EDRSilencer.
This rule detects the creation or launch of processes or files that match known Indicators of Compromise (IOCs) from a MISP instance and exhibit low prevalence (3 or fewer occurrences) over a 10-day rolling period. This combination suggests potentially malicious activity that is not widespread, indicating a targeted attack or early-stage malware.
The analytic detects the use of `reg.exe` to export Windows Registry hives, specifically `sam`, `system`, or `security`, which may contain sensitive credentials. This activity indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network.
The analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities.
This rule detects the execution of 'esentutl' with the '/p' parameter. This command-line utility is used for database utilities, and its use with '/p' (repair mode) can be leveraged by adversaries to access or repair Extensible Storage Engine (ESE) databases, including the NTDS.dit file which contains Active Directory credential information. This technique has been observed in use by threat actors like Conti ransomware and Trickbot to gather credentials or other sensitive information from compromised systems.
This rule detects the use of 'net use' commands to connect to Windows administrative shares (C$, ADMIN$, IPC$) from a principal IP address associated with a Windows asset entity. It correlates process launch events with asset entity data, specifically looking for Windows machines within the 'Domain Computers' group. This activity can indicate lateral movement or remote access by an adversary.
Detects DNS queries to domains classified as 'Gaming Sites' within a MISP threat intelligence feed. This rule is designed to identify potential policy violations related to accessing unauthorized gaming websites.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
Whoami Command Execution
YARA-L
Detects the execution of the 'whoami' command, which is frequently used by attackers post-exploitation to identify the current user's credentials and privileges. This activity is a common step in reconnaissance and privilege escalation phases of an attack.
This rule detects the creation of new files or the launch of processes whose SHA256 hash matches an indicator of compromise (IOC) from a MISP feed. It correlates process launch or file creation events with known malicious SHA256 hashes ingested from MISP, indicating potential malware execution or presence on a system.
This rule detects when a process executes another process, and both the principal (parent) process's file hash and the target (child) process's file hash have known 'EXECUTES' relationships in VirusTotal. This indicates that VirusTotal has previously observed the parent process executing the child process, which could be a sign of malicious activity if the hashes are associated with known threats.
This rule detects the launch of processes whose executable files are identified as malicious by Google Safe Browsing and exhibit low prevalence within the environment. Specifically, it looks for process launch events where the SHA256 hash of the executable matches a hash flagged as 'CRITICAL' severity by Google Safe Browsing. Additionally, the rule filters for executables that have been observed on a maximum of 3 distinct machines over a 10-day rolling period, indicating low prevalence and a higher likelihood of being a targeted or novel threat.
Detects the execution of AddInUtil.exe, a legitimate Microsoft utility for updating Add-In deployment caches, from a directory that is not a standard Microsoft .NET Framework or WinSxS location. Adversaries may abuse this utility to proxy execution of malicious code, bypass application whitelisting, or evade defenses.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$) by users who are members of the 'Domain Admins' group. It specifically looks for process launch events where the command line contains 'net use' followed by one of the administrative share names. The rule correlates this activity with user entity data to identify if the executing user is part of the 'Domain Admins' group, indicating potential lateral movement or administrative activity.
Detects the presence and execution of Inveigh via dropped artefacts
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Page 393 of 465