Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects suspicious DLL loads by the Windows Print Spooler service from its backup driver folders. This behavior is indicative of exploitation attempts related to vulnerabilities like PrintNightmare (CVE-2021-1675, CVE-2021-34527) where an attacker can force the spooler service to load arbitrary DLLs, leading to privilege escalation or remote code execution.
Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
Detects the execution of a Microsoft Office application (Excel, PowerPoint, Word) that attempts to open a document located in a trusted Microsoft Office location. Attackers often leverage this technique to bypass macro security warnings and execute malicious code, as documents in trusted locations may not trigger security prompts. The rule specifically looks for parent processes like explorer.exe or dopus.exe launching these Office applications with command-line arguments pointing to documents within known trusted paths such as AppData\Roaming\Microsoft\Templates or Microsoft Office\root\Templates. It filters out common template file extensions (.dotx, .xltx, .potx) to reduce false positives.
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Detects the execution of Windows binaries from within a Windows Subsystem for Linux (WSL) instance. This technique can be used by adversaries to masquerade parent-child process relationships, making it harder to detect malicious activity.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
This rule detects when 'sigverif.exe' spawns child processes that are not 'WerFault.exe'. 'sigverif.exe' is a legitimate Windows binary used for verifying file signatures. However, it can be abused as a Living Off the Land Binary (LOLBIN) to proxy execution of other malicious processes, thereby bypassing application whitelisting or other security controls. The rule specifically filters out 'WerFault.exe' as a common and legitimate child process of 'sigverif.exe' to reduce false positives.
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.
Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
Detects when a user downloads a file from an IP based URL using CertOC.exe
Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.
Detects the installation of VsCode tunnel (code-tunnel) as a service.
Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
Page 437 of 465