Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,537 detections
Filters
Last updated
All Time
Detection languages
2,472
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,445
11,833
5,875
5,151
4,864
4,537
Platforms
3,835
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,600
1,418
1,298
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Identify process creations that are tagged exploit in VT
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager
Detects extraction of ntds.dit file using vssadmin.exe or ntdsutil.exe with wmic as identified in CISA Living off the Land pdf
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
This rule detects the creation of specific files associated with the Kapeka backdoor. It looks for files created in common application data directories (ProgramData or AppData\Local) that have a 5-6 character alphanumeric name followed by a ".wll" extension. Additionally, it specifically looks for files named "win32log.exe" or "crdss.exe" in these locations, which are known indicators of the Kapeka backdoor. The Kapeka dropper disguises these files as legitimate to evade detection.
Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.
Detects the artifacts generally associated with the use of wmiexec.py
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
IOC Hash Prevalence
YARA-L
Detect process/file events that match hashes found in our MISP instance and have low rolling max prevalence
IOC SHA256 Hash
YARA-L
Detect file/process events that match watchlisted hashes in MISP
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
Identify process and file creation using safe browsing hashes where the first and last seen are more than 7 days apart
Detect web traffic to a recently expired domain followed by an exe file creation event
Detects the creation of a malicious DLL file named 'iphlpapi.dll' within the 'AppData\Local\Microsoft' directory, which is commonly used by applications like Microsoft Teams or OneDrive. This technique is often employed for DLL sideloading, where a legitimate application loads a malicious DLL placed in a specific directory, leading to code execution, persistence, privilege escalation, or defense evasion.
Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). This technique is commonly used to achieve DLL hijacking, which can lead to defense evasion, persistence, and privilege escalation.
Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by an attacker to block EDR/AV components while allowing their own malicious code to run on the system. The rule specifically looks for file creation events in the default WDAC policy directory and filters out known legitimate processes that manage these policies.
The analytic identifies instances of `mshta.exe` writing files to world-writable directories. It leverages Sysmon EventCode 11 logs to detect file write operations by `mshta.exe` to directories like `C:\Windows\Tasks` and `C:\Windows\Temp`. This activity is significant as it often indicates an attempt to establish persistence or execute malicious code, deviating from the utility's legitimate use. If confirmed malicious, this behavior could lead to the execution of multi-stage payloads, potentially resulting in full system compromise and unauthorized access to sensitive information.
The following analytic identifies the use of the right-to-left override (RTLO) character in file names. It leverages data from the Endpoint.Filesystem datamodel, specifically focusing on file creation events and file names containing the RTLO character (U+202E). This activity is significant because adversaries use RTLO to disguise malicious files as benign by reversing the text that follows the character. If confirmed malicious, this technique can deceive users and security tools, leading to the execution of harmful files and potential system compromise.
Page 207 of 217