Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Checkpoint Researchers published an Article with a Behavior Analysis of the Pure Malware Family. This Query is based on the Analysis of the Researchers. thx to Checkpoint.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
This rule detects the execution of PowerShell (powershell.exe or pwsh.exe) that contains obfuscated commands, specifically looking for the presence of '$env:TEMP' and 'ActiveXObject' or a combination of 'split', 'reverse', and 'join' in the command line. This PowerShell execution is correlated with the creation of a .LNK file within a 5-minute window prior to the PowerShell process start, suggesting the LNK file might be used as an initial execution vector for the obfuscated PowerShell command. This pattern is indicative of malware like PureCoder.
The analytic detects a process creating a `.lnk` file in suspicious locations such as `C:\Users\*` or `*\Local\Temp\*`. This activity is significant because creating `.lnk` files in these directories is a common tactic used by spear phishing tools to establish persistence or execute malicious payloads. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary code, or further compromise the system.
This analytic detects the creation of URL shortcut files (.url) outside of common, legitimate directories. Such activity is often associated with malware, including ransomware like CHAOS. Malicious .url files can be used to trick users into visiting harmful websites or, if placed in specific locations (e.g., Windows Startup folder), can achieve persistence and execute malicious code upon system reboot, leading to system compromise and data loss.
The following analytic detects .cab files being written to disk. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on events where the file name is '*.cab' and the action is 'write'. This activity is significant as .cab files can be used to deliver malicious payloads, including embedded .url files that execute harmful code. If confirmed malicious, this behavior could lead to unauthorized code execution and potential system compromise. Analysts should review the file path and associated artifacts for further investigation.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk. It leverages data from the Endpoint data model, specifically monitoring process and filesystem activities. This behavior is significant as it may indicate the use of Outlook to deliver malicious payloads or exfiltrate data via compressed files. If confirmed malicious, this activity could lead to unauthorized data access, data exfiltration, or the delivery of malware, potentially compromising the security of the affected system and network.
The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery.
The following analytic detects the creation or dropping of executable or script files in the root directory of a removable drive. It leverages data from the Endpoint.Filesystem datamodel, focusing on specific file types and their creation paths. This activity is significant as it may indicate an attempt to spread malware, such as ransomware, via removable media. If confirmed malicious, this behavior could lead to unauthorized code execution, lateral movement, or persistence within the network, potentially compromising sensitive data and systems.
The analytic detects Microsoft Office products writing `.cab` or `.inf` files, which is indicative of exploitation related to CVE-2021-40444. This activity may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector that can lead to remote code execution and system compromise.
The analytic detects the creation of image files (PNG, JPG, BMP, GIF, TIFF) in the AppData\Roaming folder by processes that also have a file reference in the same folder. This behavior is commonly associated with malware, such as the Remcos RAT, which captures screenshots and stores them in the AppData folder before exfiltrating them to a command-and-control server. If confirmed malicious, this activity could indicate unauthorized data capture and exfiltration, compromising sensitive information and user privacy.
The following analytic detects the creation of .iso.lnk files in the %USER%\AppData\Local\Temp\<random folder name>\ path, indicating that an ISO file has been mounted and accessed. This detection leverages the Endpoint.Filesystem data model, specifically monitoring file creation events in the Windows Recent folder. This activity is significant as it may indicate the delivery and execution of potentially malicious payloads via ISO files. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further system compromise.
This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.
The following analytic detects the creation of archived files in a temporary folder, which may contain collected data. This behavior is often associated with malicious activity, where attackers compress sensitive information before exfiltration. The detection focuses on monitoring specific directories, such as temp folders, for the presence of newly created archive files (e.g., .zip, .rar, .tar). By identifying this pattern, security teams can quickly respond to potential data collection and exfiltration attempts, minimizing the risk of data breaches and improving overall threat detection.
Detects the creation of batch (.bat) files within the Windows Startup folder, a common persistence mechanism. The rule prioritizes detection of files matching known malicious patterns, specifically 'HealthApp-*.bat' associated with the SORVEPOTEL malware, and flags other generic batch file creations in the Startup folder for investigation.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This analytic detects the creation of `sqlite32.dll` or `sqlite64.dll` files within the `%temp%` directory. This activity is often associated with the IcedID malware, which utilizes sqlite3 modules to parse browser databases and exfiltrate sensitive information like banking details, credit card information, and credentials. Detection of this behavior could indicate data theft and compromise of user accounts.
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker. Adversaries may create this file to test AppLocker policies or to bypass them.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
This rule detects when specific Windows executables (csrss.exe, lsass.exe, RuntimeBroker.exe, sihost.exe, smss.exe, wininit.exe, winlogon.exe, dllhost.exe, rundll32.exe, svchost.exe) write files with suspicious extensions such as .bat, .dll, .exe, .hta, .iso, .ps1, .txt, .vbe, and .vbs. This behavior can indicate defense evasion or other malicious activity where legitimate system processes are abused to drop or create malicious files.
Page 196 of 217