Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the presence and execution of the Inveigh hack tool by monitoring for the creation of its characteristic log and executable files. Inveigh is a PowerShell-based tool used for network sniffing, LLMNR/NBNS/mDNS spoofing, and NTLM relay attacks.
Detects AnyDesk writing binary files to disk other than "gcapi.dll". According to RedCanary research, it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll, which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API.
Detects the creation of temporary files (sam.tmp, sec.tmp, sys.tmp) in the Windows temporary directory, which are indicators of the RemoteKrbRelay SMB Relay attack module attempting to dump secrets from the Security Account Manager (SAM) and other system hives.
This rule detects the creation of 'TeamViewer_Desktop.exe' on a Windows system. This file is typically created during the installation of TeamViewer, a legitimate remote access tool. Adversaries often abuse such tools for command and control, making its installation a potential indicator of compromise.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
This rule detects the creation of a file named 'dumpert.dmp' which is the default output file name used by the Outflank Dumpert tool. Outflank Dumpert is a known tool used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process, typically for credential harvesting.
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, which is a common technique for credential access.
This rule detects the creation of files with names commonly associated with credential dumping tools or files produced by them. It looks for specific filenames or patterns in the full path of newly created files, such as logs from fgdump, kirbi files, pwdump outputs, cachedump executables, procdump outputs, and Windows Credential Editor (WCE) related files. This indicates an attempt to extract credentials from the system.
This rule detects the execution or creation of files identified as Remote Access Tools (RATs) based on a Google Cloud Threat Intelligence (GCTI) feed. It correlates process launch, module load, or file creation events with known SHA256 hashes of RATs provided by the GCTI feed. The rule specifically looks for events where the SHA256 hash of the process or file matches a hash from the 'Remote Access Tools' threat feed within the GCTI graph.
This rule detects when an executable file (.exe) creates another executable file (.exe). This behavior can be indicative of malicious activity such as malware dropping its components, or legitimate software installers. The rule includes extensive filters to reduce false positives from common system processes, update utilities, and known application behaviors like those from Microsoft Teams, VS Code, and GitHub Desktop.
Detects the execution of Impacket's wmiexec.py tool by identifying characteristic command-line arguments and temporary file creation patterns. Specifically, it looks for process launches with command lines redirecting output to a hidden ADMIN$ share path (e.g., `1>\ADMIN$\__... 2>&1`) or the creation of files in the `\windows\__` directory, which are common artifacts left by wmiexec.py.
Detects the creation of the default output filename used by the wmiexec tool, which is part of the Impacket toolkit. This typically indicates lateral movement or execution of commands via WMI.
This rule detects the creation of specific files associated with the Octopus Scanner malware. The malware creates files named 'Cache134.dat' and 'ExplorerSync.db' within the user's local AppData\Microsoft directory. This activity is indicative of the malware's presence and operation.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects attempts to extract the ntds.dit file, which contains Active Directory credential information, using `wmic` in conjunction with `vssadmin.exe` or `ntdsutil.exe`. It also identifies the creation of `.dit` files in temporary directories and specific ESENT application event logs associated with NTDS database activity. This activity is indicative of credential dumping, a common post-exploitation technique.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
This rule identifies process and file creation events where the associated file's SHA256 hash is present in Google Safe Browsing data and has been observed for a duration greater than 7 days (604,800 seconds). This long observation period for a Safe Browsing-flagged hash could indicate persistent malware or a file that has been present on systems for an extended time before being flagged or detected.
This rule detects the creation or launch of processes or files that match known Indicators of Compromise (IOCs) from a MISP instance and exhibit low prevalence (3 or fewer occurrences) over a 10-day rolling period. This combination suggests potentially malicious activity that is not widespread, indicating a targeted attack or early-stage malware.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
This rule detects the creation of new files or the launch of processes whose SHA256 hash matches an indicator of compromise (IOC) from a MISP feed. It correlates process launch or file creation events with known malicious SHA256 hashes ingested from MISP, indicating potential malware execution or presence on a system.
Page 206 of 217