Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects suspicious child processes spawned by the VMware Tools daemon (vmtoolsd.exe). Adversaries may leverage vmtoolsd.exe to establish persistence by executing various scripting and command-line interpreters such as cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. The rule specifically filters out legitimate VMware Tools scripts related to power management to reduce false positives.
Detects the execution of javaw.exe from an AppData folder, which is a known behavior of Adwind RAT (also known as jRAT). Additionally, it detects the execution of cscript.exe with specific command-line arguments related to 'Retrive.vbs', which could indicate further malicious activity or a different variant/stage of the attack.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects the creation of the default named pipe '\PSEXESVC' which is commonly used by PsExec for remote service execution. This pipe is created when PsExec attempts to establish a service on a remote system to execute commands.
This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Detects process executions characteristic of Formbook malware. Specifically, it looks for processes originating from System32 or SysWOW64 directories with an executable extension, that then execute a command line containing '/c', 'del', and paths within 'C:\Users\<user>\AppData\Local\Temp\' or 'C:\Users\<user>\Desktop\'. It also covers a variant using '/C' and 'type nul >' for deletion on the Desktop. The rule aims to avoid false positives by excluding parent processes with command line parameters, suggesting an injection scenario where the parent process itself doesn't have complex command line arguments.
Detects potential shellcode injection attempts by monitoring process access events where a process requests specific access rights (0x147a or 0x1f3fff) and the call trace contains 'UNKNOWN'. This behavior is characteristic of tools like Metasploit's migrate and Empire's psinject, which inject shellcode into other processes. The rule includes filters to reduce false positives from legitimate system processes like Wmiprvse.exe accessing Lsass.exe, Dell software interactions, and Microsoft Visual Studio processes.
This rule detects the creation of an 'explorer.exe' child process from common shell processes such as 'cmd.exe', 'powershell.exe', or 'pwsh.exe'. Attackers may use 'explorer.exe' as a proxy for execution to evade defense mechanisms. While this activity can be legitimate, it is often indicative of anomalous behavior and has been observed in use by threat actors like Muddy Waters.
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
This rule detects unusual parent or child processes associated with 'ImagingDevices.exe' (Windows Contacts). Specifically, it looks for 'ImagingDevices.exe' being spawned by 'WmiPrvSE.exe', 'svchost.exe', or 'dllhost.exe', or for 'ImagingDevices.exe' spawning any child process. This activity has been observed in connection with Bumblebee malware operations, where adversaries might abuse legitimate processes for execution or defense evasion.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
Detects exploitation of the DNS RCE vulnerability (CVE-2020-1350) by monitoring for suspicious sub-processes spawned by the `dns.exe` service. This rule specifically looks for processes created by `dns.exe` that are not common or expected system processes, indicating potential post-exploitation activity after successful exploitation of the vulnerability.
Detects the creation of a suspicious Alternate Data Stream (ADS) file, specifically a ':Zone.Identifier' stream, by processes other than common web browsers. The ':Zone.Identifier' ADS is used by Windows to mark files downloaded from the internet, indicating their origin and often triggering security warnings. This rule looks for the creation of this ADS with a 'ZoneId=3' (indicating an internet origin) on executable or document file types. By filtering out known browser processes, the rule aims to identify instances where other applications or scripts might be creating these ADS files, potentially as a defense evasion technique to bypass security warnings or to masquerade malicious files.
Detects suspicious execution of rundll32.exe with specific DLLs and functions that are known to be abused for defense evasion and arbitrary code execution, often referred to as Living Off The Land Binaries (LOLBINs). The rule identifies various combinations of DLLs (e.g., url.dll, zipfldr.dll, shell32.dll, mshtml.dll, advpack.dll, ieadvpack.dll, ieframe.dll, shdocvw.dll, syssetup.dll, setupapi.dll, pcwutl.dll, dfshim.dll, scrobj.dll, shimgvw.dll, comsvcs.dll) and their associated functions that can be used to execute scripts, open URLs, or perform other actions in an unexpected manner via rundll32.exe. It includes filters to reduce false positives from legitimate system activities like screensaver or control panel operations.
This rule detects instances where specific system binaries (msdtc.exe or gpsvc.exe) are executed from non-standard Windows system directories. This behavior is often indicative of masquerading, where malicious executables are named after legitimate system processes to evade detection, a tactic known to be used by the Lazarus Group.
Page 439 of 465