Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
69 detections
Filters
Last updated
All Time
Detection languages
52
5
5
4
1
Contributors
13
13
11
5
4
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
50
34
6
3
2
Products / Services
56
26
5
2
1
MITRE Techniques
33
29
29
25
25
IDS Classtypes
1
IDS Protocols
1
Detects DLL files written to common Windows user directories, including Desktop, Downloads, Pictures, Videos, Documents, Music, and other user profile folders. These files may be written by archive extraction utilities such as Windows Explorer, 7-Zip, or WinRAR, web browsers during downloads, or other applications.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
This rule detects potential spearphishing activity by correlating email attachments containing specific 'Request for Quotation' filenames with subsequent suspicious file creation events on endpoints. It specifically looks for matching attachments (MSG or PDF) from email logs and tracks if similar file patterns appear in Microsoft Outlook content or temporary folders on host devices.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Identifies emails with low text content but containing image attachments (.png/.jpg) associated with QR code "Quishing" attacks, a rising Q1 trend. The rule specifically looks for image attachments with filenames containing keywords like 'scan', 'qr', 'barcode', 'auth', or 'mfa', and joins this with email events that have no URLs, indicating the QR code is the primary call to action.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
This rule detects emails containing archive file attachments (zip, rar, 7z). It summarizes the count of such archives per sender, recipient, and file name over a daily period. The rule specifically looks for instances where at least one archive is present in an email.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
Page 1 of 4