Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects registry persistence attempts via Run and RunOnce keys in both user and machine hives, focusing on value names and data referencing known Subtle Snail malicious files and suspicious payload names. Tracks registry modifications indicating adversary attempts to maintain persistent execution through stealthy implant DLLs and executables.
Detects PowerShell execution patterns associated with the "Cache Smuggling" technique. This involves copying browser cache files, searching them with regex for an embedded payload, and then writing and executing that payload. This specific variant was observed being launched by conhost.exe in headless mode to conceal the window.
The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
Detects high-fidelity execution of executables spawned from Office applications or browsers after engaging with recruitment-themed lures (e.g., LinkedIn, careers). Focuses on EXE files created and executed within 24 hours in user directories (Downloads, Temp, AppData), reflecting Subtle Snail’s social engineering and document-based initial access methods.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Detects suspicious scheduled task creation (schtasks.exe /create) linked to known Subtle Snail file hashes, malicious payload filenames, and recruitment paths. Correlates with parent processes commonly abused (browsers, explorer) and excludes benign system processes and service accounts. Aggregates events to highlight clustered activity for effective threat hunting.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
Detects high-fidelity DLL side-loading in user-writable folders (Downloads, AppData, Temp) where an unsigned or untrusted DLL—created shortly before it is loaded—is executed by a trusted, signed process. This query correlates DLL load timing, signature metadata, and parent process trust to surface sophisticated attack chains, such as those used by Subtle Snail and Lazarus APT groups.
Detects PowerShell processes launched by web browsers (Chrome, Edge, Firefox, Internet Explorer) or Windows Explorer, especially when using suspicious command-line arguments like encoded commands, Invoke-Expression, or web download functions. This behavior can indicate an attempt to execute malicious scripts, often initiated through user interaction (e.g., clicking a malicious link or opening a crafted file).
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
Checkpoint Researchers published an Article with a Behavior Analysis of the Pure Malware Family. This Query is based on the Analysis of the Researchers. thx to Checkpoint.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
RedCanary recommends to create a Policy wich opens js files in Notepad (https://redcanary.com/blog/threat-intelligence/notepad-javascript/) to prevent the execution of malicious payloads.
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
This detection helps to identify if an ASN that typically handles an average of X connection requests per day over a consistent 7-day period suddenly triples—or more—the number of requests. (You can adjust this line to define the exact multiplication threshold). In addition, identify if during the last week, a new ASN has triggered more than 1K connection attempt during a day.
This analytic detects the creation of URL shortcut files (.url) outside of common, legitimate directories. Such activity is often associated with malware, including ransomware like CHAOS. Malicious .url files can be used to trick users into visiting harmful websites or, if placed in specific locations (e.g., Windows Startup folder), can achieve persistence and execute malicious code upon system reboot, leading to system compromise and data loss.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
This rule detects successful network connections from devices to domains identified as high-confidence threats by ThreatView.io. It specifically looks for outbound connections to public IP addresses where the remote URL's domain matches an entry in the ThreatView high-confidence feed.
The following analytic detects the loading of drivers from suspicious paths, which is a technique often used by malicious software such as coin miners (e.g., xmrig). It leverages Sysmon EventCode 6 to identify drivers loaded from non-standard directories. This activity is significant because legitimate drivers typically reside in specific system directories, and deviations may indicate malicious activity. If confirmed malicious, this could allow an attacker to execute code at the kernel level, potentially leading to privilege escalation, persistence, or further system compromise.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a
Detects the creation of batch (.bat) files within the Windows Startup folder, a common persistence mechanism. The rule prioritizes detection of files matching known malicious patterns, specifically 'HealthApp-*.bat' associated with the SORVEPOTEL malware, and flags other generic batch file creations in the Startup folder for investigation.
Page 465 of 509