Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a specific image load pattern where 'svchost.exe' loads 'clfsw32.dll'. This pattern has been observed in the context of a tool named PRIVATELOG, which is associated with advanced persistent threat (APT) activities, and is considered rare under legitimate circumstances. This behavior could indicate process injection or other forms of defense evasion.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific uncommon access flags (0x410 and 0x01410). These flags are often used by tools or techniques designed to dump credentials from LSASS, a common method for credential theft on Windows systems. The rule includes extensive filters to reduce false positives from legitimate software that might interact with LSASS.
Detects the creation of a remote thread by 'Ttdinject.exe', which can be abused as a proxy to execute malicious code. This technique is often used for defense evasion.
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
Detects suspicious child processes spawned by "BgInfo.exe" or "BgInfo64.exe". This behavior can indicate an attempt to abuse BgInfo, a legitimate Microsoft utility, for proxy execution of other binaries or scripts, often to bypass application whitelisting or other security controls. The rule specifically looks for common command-line interpreters (cmd.exe, powershell.exe, cscript.exe, wscript.exe), other executables (calc.exe, notepad.exe, mshta.exe), or executables launched from suspicious user-writable directories (AppData, Users\Public, Temp, PerfLogs).
Finger.EXE Execution
Sigma
Detects the execution of the "finger.exe" utility, which is an old Windows utility used to display information about users on a remote computer running the finger service. Due to its age and the rarity of the finger service being active, any execution of this utility is considered suspicious and warrants investigation.
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
Detects the loading of `dbghelp.dll` or `dbgcore.dll` by processes that are typically not expected to load these DLLs. These DLLs export functions like `MiniDumpWriteDump` which can be used to dump process memory, including sensitive information like credentials from processes such as LSASS. This behavior is often observed in attacker tradecraft, such as with the SilentTrinity C2 Framework, or by legitimate debugging tools like ProcessHacker. The rule includes filters for common legitimate Windows processes and services that might load these DLLs to reduce false positives. Investigation of the command line and image location of the process loading the DLL is recommended.
Detects a PowerShell process attempting to access the Local Security Authority Subsystem Service (LSASS) process memory. This activity is a strong indicator of potential credential dumping attempts, where an attacker tries to extract sensitive authentication material (like passwords or hashes) from memory.
Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc. This can be used by malicious actors to create malicious Office documents with macros on the fly.
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Detects an attempt to dump credentials from the VeeamBackup database using sqlcmd.exe by querying the 'VeeamBackup.dbo.Credentials' table. This activity is indicative of an attacker trying to extract sensitive information, potentially for lateral movement or further compromise.
This rule detects potential successful exploitation of CVE-2021-26857, a Microsoft Exchange Server vulnerability. It specifically looks for abnormal child processes spawning from the 'UMWorkerProcess.exe' (Unified Messaging service) on Exchange servers. The rule filters out legitimate Windows Error Reporting processes ('wermgr.exe' and 'WerFault.exe') to reduce false positives, indicating that any other process spawned by 'UMWorkerProcess.exe' is considered suspicious and a potential indicator of compromise.
Detects the creation of specific file artifacts associated with Adwind RAT (also known as jRAT). This includes 'javaw.exe' within the AppData\Roaming\Oracle\bin\java directory and '.vbs' files within a '\Retrive' directory, both known indicators of Adwind/jRAT activity.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Detects the creation of the 'ntds.dit' file, which contains Active Directory database information, by processes that are not typically associated with this activity. This rule specifically looks for 'ntds.dit' creation when the parent process is an uncommon executable (e.g., cscript.exe, powershell.exe, web server processes) or originates from suspicious directories (e.g., AppData, Temp, Public). This activity often indicates an attempt to dump Active Directory credentials.
Detects the creation of new Office macro files on systems via applications such as web browsers or email clients. This rule identifies files with common Office macro extensions (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) or those with Zone.Identifier streams indicating a download, when created by known browser or email client processes.
This rule detects when common Windows shell and scripting applications (such as bash.exe, cmd.exe, cscript.exe, powershell.exe, certutil.exe, mshta.exe, wmic.exe, etc.) write files to suspicious system folders. The suspicious folders include 'C:\PerfLogs\', 'C:\Users\Public\', and 'C:\Windows\Temp\'. This activity can indicate an adversary attempting to stage or execute malicious payloads in less scrutinized directories for persistence or defense evasion.
Detects a specific User Account Control (UAC) bypass technique involving the creation of a file named 'comctl32.dll' within a directory structure that starts with 'C:\Windows\System32\consent.exe.@'. This pattern is indicative of UACMe (specifically UACMe 22) attempting to elevate privileges by manipulating how consent.exe loads libraries.
Page 440 of 465